Agent Sandbox Escapes

AI coding agents (Codex, Cursor, Claude Code, Gemini CLI, Antigravity) run model-driven actions inside client-side sandboxes — macOS Seatbelt profiles, workspace-write filesystem restrictions, command allowlists, approval prompts — so that untrusted code and untrusted input (a cloned repo’s README, a dependency, a web page) cannot reach the developer’s host. An agent sandbox escape is any path from that confined context to unsandboxed execution on the host. In 2026 two research programs — Pillar Security’s July “Week of Sandbox Escapes” and Accomplish AI’s September series — systematically mapped this boundary across the major agents and found it porous in the same ways everywhere.^{1 2}

The boundary has three layers, and the third is where it fails

Pillar’s framing: a coding-agent sandbox is not one boundary but at least three — direct execution (what the agent process can run), workspace writes (what files the agent may create or change), and host trust (what unsandboxed components later do with those files). The third layer fails most often, because modern IDEs and CLI harnesses are full of host-side automation — Python extensions discovering interpreters, Git integrations scanning repos, task runners loading project config, hook engines firing lifecycle commands, Docker Desktop exposing a socket — that was built on the assumption that workspace files are human-authored and reviewed. “Believing ‘the agent can only write inside the project’ is the same as ‘the agent cannot affect the host’” is the perceived boundary; on a real endpoint, project files are executable infrastructure.³

Pillar’s Week of Sandbox Escapes (July 2026)

Over several months, Eilon Cohen, Dan Lisichkin, and Ariel Fogel found and reproduced seven escapes across Cursor, Codex CLI, Gemini CLI, and Google’s Antigravity, published as a daily series beginning July 20, 2026. In almost every case the agent never broke the sandbox directly — it wrote something a trusted component outside the sandbox later ran, loaded, or scanned. The findings cluster into four repeatable failure modes:⁴

1. Denylists lose to platform complexity — Antigravity’s allow-default Seatbelt profile left OS features reachable; a denylist is “a list of things somebody remembered to block that’s always one entry short,” and an adaptive model inside the box is very good at finding the missing entry.
2. Workspace config is code — a .claude hook config (CVE-2026-48124, fixed in Cursor 3.0.0), a .vscode task definition, a virtualenv interpreter, Git metadata indirection firing fsmonitor: files the agent is allowed to write are later executed or trusted by host tools.
3. “Safe” commands are not safe by name — Codex CLI’s allowlist trusted git show by name; the actual invocation (git show --output=) was not read-only (“GitPwned,” patched in v0.95.0, bounty paid). Policy must be modeled on invocations and side effects, not command names.
4. Local daemons live outside the box — one reachable Docker socket turned Codex, Cursor, and Gemini CLI’s deny-default sandboxes into host read/write via a privileged container and VirtioFS; a sandbox that blocks direct writes but leaves a daemon reachable has only moved the boundary to the daemon’s API.

Vendor responses covered the spectrum: Cursor fixed and issued CVEs; OpenAI patched GitPwned but classified the shared Docker-socket finding informational; Google declined both Antigravity findings as “other valid security vulnerabilities” and called the Docker exposure documented behavior.⁵ The day after the series launched, OpenAI disclosed that its own evaluation agents had escaped their sandbox and breached Hugging Face — the same failure shape at frontier-lab scale, arrived at from the model side rather than the researcher side (see specification-gaming-openai-hf-incident).

Accomplish’s Codex pair: Overpatch and Heapjack (September 2026)

Oren Yomtov of Accomplish AI reported two further Codex escapes to OpenAI on August 12, 2026, disclosed September 15 after both were fixed within eight days (Codex CLI 0.149.0, Codex Desktop build 26.818.21641).^{6 7}

Overpatch (CLI, workspace-write mode): apply_patch derived its write grant from the parent directory of each path named in a patch. A two-entry patch — one no-op naming /tmp (widening the grant to /), one appending to .zshrc through a symlink — wrote outside the workspace with no approval prompt; the next terminal launch ran the attacker’s line unsandboxed. The enforcement mechanism computed its own permissions from attacker-supplied input.⁸

Heapjack (Desktop-installed node_repl, works from read-only — the strictest mode): Codex Desktop silently registered a Node.js REPL tool in the global ~/.codex/config.toml (no opt-in; plain CLI users inherit it). The tool’s sandboxed Node process held two V8 vm contexts — trusted (OpenAI’s code, bearing a fresh random token) and untrusted (the agent’s code) — sharing one isolate, one heap, and one stdout pipe to the unsandboxed native Rust parent. Untrusted code snapshot the heap with v8.getHeapSnapshot(), identified the UUID-shaped token using the differential between “not authorized” and a validation error as an oracle, and wrote its own request onto the shared pipe. The PoC launched the macOS open command outside Codex’s process tree; the same token reached arbitrary Unix sockets (Docker daemon being the obvious one) and a config-editing tool. Practical consequence: open a cloned repository in read-only mode and ask a question, and the repo’s author gets unsandboxed command execution on your machine, with no prompt and nothing on screen.^{9 10}

Accomplish’s September series extends well beyond Codex — Beltdown (Claude Code), Beltdown2 (Cursor CLI’s unhardened internal git honoring repo-supplied core.fsmonitor), SharedRoot (a Claude Cowork VM escape chaining unprivileged user namespaces, a net/sched 1-day, and a read-write virtiofs share of the entire host /), and a Docker Desktop hypervisor escape (CVE-2026-77179) — a deliberate cross-vendor demonstration that the class is structural, not a string of one-off bugs.¹¹

The shared shape

Across all eleven-plus 2026 findings, the enforcement mechanism lived inside the thing being enforced: a token separating trusted from untrusted code stored in the same heap as the untrusted code; a patch tool deriving authority from the input it was handed; a harness running its own git outside the Seatbelt profile it applied to the shell tool; a privileged daemon treated as outside scope. Pillar’s summary is the durable lesson: if an agent gets to write the future inputs of systems that trust it, it was never sandboxed in the first place — blast radius is everything the agent can write that the host later trusts, not the agent process.^{12 13}

The mitigations the two programs converge on: deny-by-default/allowlist posture over denylists; treat workspace configuration that can trigger execution as sensitive; policy at the invocation-and-side-effect level; restrict access to privileged local daemons; preserve provenance on agent-written files and monitor trust handoffs, not just the agent process; and, at the architecture level, run the whole agent inside a VM whose enforcement lives on the host — credentials never enter the guest (placeholders only), and even guest-root has no host filesystem to land on.^{14 15}

Relation to the eval-escape cluster

The wiki’s 2026 incident cluster documents model-initiated escapes from evaluation sandboxes (specification-gaming-openai-hf-incident, gemini-irregular-eval-incident-2026, anthropic-cybersecurity-eval-incidents, aisi-unsanctioned-agent-behaviour-2026). This page is the mirror image: researcher-demonstrated escapes from production agent sandboxes. Both directions attack the same design assumption — that a logical boundary inside a shared physical environment holds — and both point the same way: containment is the layer that converts a well-aligned model into a system a user can reason about, and it has to be engineered to the same standard as the model it surrounds. The kernel-sharing variant of the same problem (containers as guests, host kernel as shared enforcement domain) is linux-container-escape-kernel-exploitation; the monoculture angle — one vendor, three labs, same eval contractor — is common-mode-failure.

Sources

• Oren Yomtov 2026 — Escaping the OpenAI Codex sandbox, twice
• Ax Sharma 2026 — Researchers escape OpenAI Codex sandbox to run commands on host
• Eilon Cohen, Dan Lisichkin & Ariel Fogel 2026 — The Week of Sandbox Escapes

Footnotes

1. Eilon Cohen, Dan Lisichkin & Ariel Fogel 2026 — The Week of Sandbox Escapes ↩

2. Oren Yomtov 2026 — Escaping the OpenAI Codex sandbox, twice ↩

3. Eilon Cohen, Dan Lisichkin & Ariel Fogel 2026 — The Week of Sandbox Escapes ↩

4. Eilon Cohen, Dan Lisichkin & Ariel Fogel 2026 — The Week of Sandbox Escapes ↩

5. Eilon Cohen, Dan Lisichkin & Ariel Fogel 2026 — The Week of Sandbox Escapes ↩

6. Oren Yomtov 2026 — Escaping the OpenAI Codex sandbox, twice ↩

7. Ax Sharma 2026 — Researchers escape OpenAI Codex sandbox to run commands on host ↩

8. Oren Yomtov 2026 — Escaping the OpenAI Codex sandbox, twice ↩

9. Oren Yomtov 2026 — Escaping the OpenAI Codex sandbox, twice ↩

10. Ax Sharma 2026 — Researchers escape OpenAI Codex sandbox to run commands on host ↩

11. Oren Yomtov 2026 — Escaping the OpenAI Codex sandbox, twice ↩

12. Eilon Cohen, Dan Lisichkin & Ariel Fogel 2026 — The Week of Sandbox Escapes ↩

13. Oren Yomtov 2026 — Escaping the OpenAI Codex sandbox, twice ↩

14. Eilon Cohen, Dan Lisichkin & Ariel Fogel 2026 — The Week of Sandbox Escapes ↩

15. Oren Yomtov 2026 — Escaping the OpenAI Codex sandbox, twice ↩