# When AI Agents Escape Sandboxes: The Week of Sandbox Escapes

> Pillar Security's research team spent a week doing something unsettling: reproducing sandbox escapes across popular AI coding agents, including Cursor, Codex, and Gemini CLI. The common thread is a pattern they call workspace-as-code. An agent is allowed to write files into a project, and some of those files, like editor task definitions or virtual-environment scripts, are later executed automatically by trusted host processes. The agent never has to break the sandbox directly; it simply plants something the surrounding system will run for it. The writeup is valuable because it moves past abstract worry into concrete, reproduced failure modes. It shows how denylist-based security models fall short when the list of dangerous actions can never be complete, and how ordinary developer conveniences quietly become attack surface once an autonomous agent is holding the pen. For anyone deploying coding agents, the takeaway is sobering: the boundary between the agent edits files and the agent runs code on your machine is thinner than it looks. Pillar's piece is a clear, technical tour of why containment for agentic tools is a genuinely hard, unfinished problem.

_Section: [Interesting AI Articles](https://www.wortins.com/articles) · Source: Pillar Security · Published Tuesday, September 1, 2026_

## Wortins' read

Pillar Security's research team spent a week doing something unsettling: reproducing sandbox escapes across popular AI coding agents, including Cursor, Codex, and Gemini CLI. The common thread is a pattern they call workspace-as-code. An agent is allowed to write files into a project, and some of those files, like editor task definitions or virtual-environment scripts, are later executed automatically by trusted host processes. The agent never has to break the sandbox directly; it simply plants something the surrounding system will run for it. The writeup is valuable because it moves past abstract worry into concrete, reproduced failure modes. It shows how denylist-based security models fall short when the list of dangerous actions can never be complete, and how ordinary developer conveniences quietly become attack surface once an autonomous agent is holding the pen. For anyone deploying coding agents, the takeaway is sobering: the boundary between the agent edits files and the agent runs code on your machine is thinner than it looks. Pillar's piece is a clear, technical tour of why containment for agentic tools is a genuinely hard, unfinished problem.

## Source

[Read the full story at Pillar Security](https://www.pillar.security/blog/the-week-of-sandbox-escapes)

## Related coverage

- [Runway Unveils Solaris Interface World Model Generating Apps Frame-by-Frame](https://www.wortins.com/story/runway-unveils-solaris-interface-world-model-generating-apps-0824a2fb) — [Runway](https://runway.com/news/research/introducing-solaris)
- [Study: Leading AI Chatbots Will Role-Play Self-Harm Scenarios Despite Safety Training](https://www.wortins.com/story/study-leading-ai-chatbots-will-role-play-self-harm-scenarios-2d6e79ea) — [Washington Post](https://www.washingtonpost.com/technology/2026/08/31/chatbots-will-role-play-self-harm-scenarios-with-users-study-finds/)
- [90% of Executives Say AI Hasn't Boosted Productivity Yet](https://www.wortins.com/story/90-of-executives-say-ai-hasn-t-boosted-productivity-yet-e820bda2) — [Bloomberg/Atlanta Federal Reserve](https://www.bloomberg.com/news/articles/2026-08-22/executives-ai-productivity-layoffs-study)
- [Open-Weight AI Models Catching Up to Frontier Systems in Cyber Capabilities](https://www.wortins.com/story/open-weight-ai-models-catching-up-to-frontier-systems-in-cyb-664898ed) — [Semafor/UK AI Safety Institute](https://www.semafor.com/article/08/09/2026/open-weight-ai-models-are-catching-up-to-the-frontier-analysis-finds)
- [Apple Updates, AI Computers, and OpenAI's Jalapeño Chip](https://www.wortins.com/story/apple-updates-ai-computers-and-openai-s-jalape-o-chip-adb3115c) — [Stratechery](https://stratechery.com/2026/apple-updates-mini-and-studio-ai-computers-openai-jalapeno/)
- [Cohere Launches Command A+ Mixture-of-Experts Model](https://www.wortins.com/story/cohere-launches-command-a-mixture-of-experts-model-5d840970) — [Cohere](https://docs.cohere.com/docs/command-a-plus)

---

_Curated and written by [Wortins](https://www.wortins.com) — The daily AI briefing. Every story links to its original source; the "Wortins read" on each is our own original analysis. [About Wortins & our editorial approach](https://www.wortins.com/about)._