AI Agent Sandbox Design: 4 Lessons From New Research

Seven Findings, Coordinated Disclosure, and a Reusable Taxonomy

On July 20, 2026, Pillar Security began publishing a daily research series covering seven sandbox-escape and boundary-bypass findings across four AI coding agents. The headline detail for defenders is the boring, good one: the findings were disclosed to vendors months ago and most are already patched. What makes the series worth reading is not the individual bugs — it is the four repeatable failure modes the researchers extracted from them, which anyone building an agent sandbox can design against today.

• Seven findings across Cursor, OpenAI Codex CLI, Google Gemini CLI and Google Antigravity, researched by Eilon Cohen, Dan Lisichkin and Ariel Fogel
• Three Cursor issues fixed in version 3.0.0, including CVE-2026-48124
• A Codex CLI allowlist issue was patched in v0.95.0 with a high-severity bounty paid; a shared Docker socket issue affecting Codex, Cursor and Gemini CLI is also fixed
• Google described the research as "exceptional quality" while classifying two Antigravity findings as lower severity

What Are the Four Failure Modes?

This is the part to take back to your own architecture.

1. Denylist sandboxes cannot keep up with OS complexity. A sandbox that enumerates forbidden operations is racing against an operating system that adds new ones every release. Allowlist-shaped isolation — deny by default, permit narrowly — is the design that ages well.

2. Workspace config files are executable code. In the Cursor finding that became CVE-2026-48124, a hook configuration file sitting in the workspace turned into unsandboxed command execution. Any file the agent reads from a repository it did not write is untrusted input, and configuration formats that can invoke commands are code with a friendlier extension.

3. Allowlists that trust command names, not invocations. Codex CLI's allowlist trusted git show by name. But a command name is not a capability description — the same binary does very different things depending on arguments and repository state. Validation belongs at the invocation, not the identifier.

4. Privileged local daemons are part of your trust boundary. A shared Docker socket gave an escape path across three separate products. If a sandboxed process can talk to a daemon running with more privilege than the sandbox, the sandbox ends where that socket begins.

Why Is This a Good Story for Defenders?

Because the process worked. Research conducted over several months, reported privately, fixed by vendors, then published with credit given in both directions — Google publicly praised the quality of the work while disagreeing on the severity of two items, which is exactly the kind of open, unremarkable disagreement healthy disclosure produces. Cursor shipped fixes in 3.0.0. OpenAI patched in v0.95.0 and paid a high-severity bounty. Nobody was exploited, and everyone downstream got a better product.

It also lands in a productive moment. Agent security is being taken seriously as its own discipline, from open guardrail frameworks to open-sourced AI bug-hunting tooling. Structured taxonomies like this one are what turn a pile of individual CVEs into design guidance.

The Practical Takeaway

If you run AI coding agents, update them — Cursor 3.0.0 and Codex CLI v0.95.0 or later. If you build them, the four failure modes above are a free architecture review. And if you are writing your own agent sandbox from scratch, note that all four are boundary-definition problems rather than exotic exploitation techniques. Getting the boundary right up front is much cheaper than patching around it. More in our AI security coverage.

Sources: Pillar Security — July 20, 2026; BleepingComputer — July 2026; Pillar Security Day 5 writeup — July 2026.