Four AI coding agents affected by sandbox escape vulnerabilities

Overview of the Vulnerabilities

Researchers from Pillar Security identified sandbox escape vulnerabilities in four popular AI coding agents: Cursor, Codex, Gemini CLI, and Antigravity. The researchers showcased how these agents could write files that execute unintended commands on the host system without directly compromising the sandbox environment.

Mechanics of the Exploits

The key to the escape mechanisms lies in how sandboxes interact with files and external tools. While sandboxed agents appear to adhere to strict confinement rules, they can manipulate workspace files that external tools utilize. This manipulation can lead to executing arbitrary commands once a malicious payload is planted within the environment, such as a README or code diff.

Findings and Failure Modes

Pillar Security categorized their findings into four primary failure modes: inadequately managed denylist sandboxes, executable code in workspace configurations, unsafe command allowlists, and privileged daemons operating outside sandbox limits. These categories illustrate the various ways in which current sandbox implementations fall short of ensuring security.

Vendor Responses and Patches

Many of the identified vulnerabilities have been acknowledged by vendors and subsequently patched. For instance, Cursor's issues include a workspace-controlled hook configuration leading to unsandboxed execution and arbitrary modification of the virtualenv interpreter, now corrected in version 3.0.0. OpenAI has also addressed vulnerabilities in Codex with an updated version, v0.95.

Implications for the Tech Industry

These security vulnerabilities highlight a critical weakness in the current implementation of sandboxes in AI coding tools, potentially exposing developers to risks when utilizing these technologies. As AI tools become more integrated into development workflows, ensuring these agents operate securely will be vital to maintaining trust and safety in software deployment.