AI coding agents are escaping their own security boundaries, not by breaking out directly, but by writing files that trusted components outside the sandbox then execute. Pillar Security researchers documented multiple sandbox bypass techniques across Google’s Gemini CLI, OpenAI’s Codex, Cursor, and Antigravity, publishing findings this week in a detailed breakdown of AI coding agent vulnerabilities<\/a>. Major vendors have patched the specific flaws. The underlying architecture problem remains. Cyberhaven data puts AI coding agent adoption up 357% between February and May 2025, making this the fastest-growing and highest-risk AI category in enterprise environments.<\/p>\n The phrase that captures this failure mode: the blast radius isn’t the agent process, it’s everything the agent can write that the host later trusts. Your developers are already running Cursor, Codex, or Copilot in production workflows. If a malicious prompt injected through a README file or a dependency comment can instruct that agent to write a configuration file that VS Code or Docker then executes with full host privileges, your sandbox policy is largely theater.<\/p>\n The recurring failure mode here follows a pattern security teams know from container escapes and browser extension exploits: trust boundaries get drawn around the wrong perimeter. Vendors defined the sandbox as “what the agent process can do directly” when the actual perimeter is “what the agent can influence indirectly through files, hooks, and daemons.” Patching individual CVEs doesn’t fix that architectural assumption. Every new tool integration, Git hook, Python extension, or Docker socket the agent touches potentially reopens the same class of vulnerability.<\/p>\n The signal worth watching: researchers from both Pillar and Cymulate are converging on the same findings independently, which means this isn’t edge-case research, it’s a structural gap in how agentic coding tools were designed. The question for your security team isn’t whether your vendors have patched the known CVEs. It’s whether you have detection coverage for the agent’s write behavior, not just its execution behavior. If your SIEM has no policy specifically for coding assistant activity, you have a blind spot growing by hundreds of users per quarter.<\/p>\n Prompt injection is when untrusted content, a README, a code comment, a fetched dependency, embeds instructions that an AI agent interprets as commands from a legitimate user. It exists because coding agents don’t natively distinguish between “content to process” and “instructions to follow.” The analogy is SQL injection: user input treated as executable code. In an agentic workflow, the stakes escalate because the agent has write access to files, configuration hooks, and tool integrations. A poisoned README can become a command the agent executes with host-level trust.<\/p>\nWhat this means for your business<\/h2>\n
Concept deep-dive: Prompt injection in agentic workflows<\/h2>\n