Although AI coding agents were marketed as safely sandboxed assistants, a wave of documented escapes has exposed systemic design flaws across leading tools including Cursor, Codex CLI, Gemini CLI, Antigravity, Claude Code, and GitHub Copilot. Researchers found that these agents could be driven to execute code directly on the host system with user-level privileges, despite sandbox configurations intended to confine activity to limited workspaces. The incidents were grouped into a widely publicized “week of sandbox escapes,” signaling that the failures stemmed from shared architectural assumptions rather than isolated implementation bugs in any single tool.
In several disclosures, the agents wrote files or configurations that appeared harmless inside the sandbox but were later executed by trusted external tools, quietly transforming everyday automation into remote code execution chains. Security reviews documented unsandboxed downstream tools as a recurring weak link, with multiple escape vectors relying on trusted utilities that later executed agent-written files outside the sandbox.
A recurring pattern across the reported exploits is Configuration-Based Sandbox Escape, where attackers abuse the agent’s own startup behavior and configuration files instead of attacking the operating system directly. By modifying trusted settings or redirecting execution paths, adversaries arranged for payloads planted inside the sandbox to run the next time the host-side tool launched, bypassing sandbox enforcement altogether.
For Claude Code, one chain involved creating a malicious settings file that remained dormant until the user restarted the tool, at which point arbitrary commands executed with full host privileges. Gemini CLI exhibited a similar weakness when untrusted workspace content was automatically treated as legitimate configuration and executed before sandbox initialization, reflecting a broader trust problem in agent configuration layers.
Prompt injection widened the attack surface further, as adversaries embedded instructions in README files, issue descriptions, or dependency metadata that persuaded agents to generate malicious files. Those files were then executed by trusted tooling such as linters, build systems, Git hooks, or CI runners, allowing sandboxed agents to indirectly trigger unsandboxed code on developer machines and infrastructure.
Cursor was shown vulnerable to a single crafted prompt that led the agent to write a configuration artifact disabling sandbox enforcement, after which subsequent commands ran with full system privileges. Some attacks also exploited human-in-the-loop safeguards by manipulating interface wording and visual cues, causing users to approve operations misrepresented as routine or safe despite their actual impact on host execution.
Underlying these incidents are repeated sandbox design failures, including path validation gaps, overtrusted local daemons, and configuration files that function as executable code rather than inert project metadata. Denylist-style sandboxes struggled to keep pace with operating system complexity, while “safe” command allowlists focused on command names instead of specific invocations, enabling subtle flag or argument changes to bypass controls.
Vendors issued public advisories and emergency patches for tools like Gemini CLI and Cursor, tightening configuration handling and workspace protections, but such fixes treat symptoms of deeper architectural trust problems. Securing these agents now requires rethinking trust boundaries, identities, execution models, and automation at scale.
