{"id":4627,"date":"2026-07-22T15:10:31","date_gmt":"2026-07-22T15:10:31","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/07\/22\/security-risks-from-ai-coding-agents-expand-beyond-the-sandbox-pillar\/"},"modified":"2026-07-22T15:10:31","modified_gmt":"2026-07-22T15:10:31","slug":"security-risks-from-ai-coding-agents-expand-beyond-the-sandbox-pillar","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/07\/22\/security-risks-from-ai-coding-agents-expand-beyond-the-sandbox-pillar\/","title":{"rendered":"Security Risks from AI Coding Agents Expand Beyond the Sandbox: Pillar"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

AI coding assistants have become an essential part of developers\u2019 work, automating many of the repetitive tasks \u2013 think boilerplate coding and scaffolding \u2013 that in the past ate up a lot of their time. More jobs can now get done faster.<\/p>\n

That said, such agents also represent a significant security risk, making developers \u2013 who were already targets of cybercriminals \u2013 even more attractive. In recent weeks, cybersecurity researchers have reported on such threats as \u201cHalluSquatting<\/a>\u201d and \u201cGhostApproval<\/a>,\u201d which target developers and their AI tools.<\/p>\n

That\u2019s in part because the adoption of AI coding agents is outpacing the development of security tools to protect them. Cyberhaven Lab researchers<\/a> noted in May that adoption of AI coding agents was growing faster than the use of any other AI tool, jumping 357% between February 2025 and this year. They also are the highest-risk category.<\/p>\n

\u201cWhen a developer pastes a code block into a coding assistant, or when an agentic coding tool browses a local repo autonomously, the data exposure isn\u2019t hypothetical,\u201d wrote<\/a> Mike Leon, machine learning engineer with Cyberhaven. \u201cIt\u2019s immediate. Security teams that haven\u2019t built specific detection and policy coverage for coding assistant activity are operating with a significant blind spot, one that is growing by hundreds of users per quarter.\u201d<\/p>\n

The Threat Outside of the Sandbox<\/h3>\n

Over the past several months, Pillar Security researchers have written about a range of security flaws in the sandboxes of four popular coding agents \u2013 Google\u2019s Gemini CLI, OpenAI\u2019s Codex, Cursor, and Antigravity \u2013 that can be abused without directly targeting the sandboxes themselves. Instead, the coding agents needed only to create files that a trusted component outside of the sandbox would later be processed \u2013 run, loaded, scanned, and treated as safe \u2013 by a trusted component outside of the sandbox.<\/p>\n

\u201cIn aggregate, these vulnerabilities show that AI coding agents change the endpoint threat model, and that most sandbox designs have not caught up,\u201d researchers Eilon Cohen, Dan Lisichkin, and Ariel Fogel wrote in a report this week dubbed \u201cThe Week of Sandbox Escapes<\/a>.\u201d \u201cThe bottom line is that an agent\u2019s blast radius is not the agent process; it includes everything the agent can write that the host later trusts.\u201d<\/p>\n

The AI agents themselves can work \u2013 and remain \u2013 in the sandbox, so the issue isn\u2019t a standard escape. The problem is the files an agentic CLI or IDE produce inside the sandbox can be read and acted upon outside of it. Coding agents run their own tools outside of the sandbox, from Python extensions that resolve interpreters and Git integrations that scan repositories to VS Code running task files, hook engines firing lifecycle commands, and Docker Desktop exposing local sockets.<\/p>\n

Prompt Injection Threat<\/h3>\n

Given that, untrusted input created via a prompt injection attack \u2013 such as malicious code in a README file, web content, a software dependency, or code comments \u2013 can be processed by the agent within the sandbox and acted upon outside of it. It\u2019s another way that threat actors can abuse the trust inherent in AI coding tools<\/a>.<\/p>\n

Pillar researchers categorized their findings into four \u201cfailure modes,\u201d including denylist sandboxes that aren\u2019t keeping up with the increasing complexity in operating systems and workspace configurations that essentially are executable code. The others are so-called safe command allowlists that trust command names rather than invocations and privileged local daemons that are located outside of the sandbox.<\/p>\n

The Security Flaws<\/h3>\n

Four of the flaws were found in Cursor, including one in which Git metadata indirection \u2013 using a pointer file instead of a Git folder \u2013 escaped the sandbox\u2019s path-based security rules, and another in which the agentic assistant could modify a virtual environment so that a Python extension could execute the changed interpreter. A third vulnerability \u2013 tracked as CVE-2026-48124 and fixed in version 3.0.0 \u2013 could turn a workspace-control Claude hook configuration file into a tool for executing commands outside of a sandbox.<\/p>\n

A vulnerability affecting Cursor, Codex, and Gemini CLI at the same time allowed agents to launch privileged containers and let a privileged local daemon become a code execution environment outside of a sandbox. Like the others, this flaw has been fixed.<\/p>\n

OpenAI patched a vulnerability in Codex CLI in which a \u201csafe\u201d command allowlist trusted a command name \u201cwithout modeling dangerous arguments and Git side effects.\u201d<\/p>\n

Pillar also downgraded two issues in Antigravity \u2013 a sandbox bypass and a macOS Seatbelt denylist bypass \u2013 saying they were difficult to exploit.<\/p>\n

An Ongoing Concern<\/h3>\n

Other researchers also have been investigating the risks of AI coding agents running inside a sandbox. Cymulate\u2019s research lab in May detailed similar sandbox-related issues<\/a> with Anthropic\u2019s Claude Code, Gemini CLI, Codex CLI, Cursor, and GitHub Copilot. Pillar\u2019s research also echoes the concerns outlined by Cymulate.<\/p>\n

\u201cAI coding agents \u2026 are rapidly becoming part of modern development workflows,\u201d the researchers wrote. \u201cThese tools are often marketed not only as productivity tools, but also as security tools capable of auditing code, detecting vulnerabilities and improving overall security posture. This research shows that the agents themselves introduce a new attack surface.\u201d<\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

AI coding assistants have become an essential part of developers\u2019 work, automating many of the repetitive tasks \u2013 think boilerplate […]<\/p>\n","protected":false},"author":1,"featured_media":4628,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-4627","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=4627"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4627\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/4628"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=4627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=4627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=4627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}