Four coding agents crossed their sandboxes. The host trust graph is the boundary.

Four coding-agent families, Cursor, Codex, Gemini CLI and Antigravity, crossed their intended sandbox boundaries in Pillar Security research published on 20 July 2026. The recurring mechanism was not a kernel break. A sandboxed agent wrote or reached something that a trusted component outside the sandbox later executed, loaded or treated as safe.

That changes the threat model for coding agents. Process isolation can work exactly as designed while the overall system still exposes a path to host execution. The boundary is therefore not the sandbox process. It is the complete graph of writable files, trusted commands, local daemons and host-side automation that can act on agent-controlled state.

Trusted readers turn sandbox writes into host actions

Pillar's research groups the failures into repeatable classes. Workspace configuration can be written inside the sandbox and consumed later by an unsandboxed IDE or CLI. A command allowlist can trust a binary name while missing arguments that make the invocation write files or invoke helpers. Local services such as Docker can also perform privileged work on behalf of a constrained process.

A sandbox is only as strong as the most privileged component willing to consume its output.

The Codex example makes the policy failure concrete. Pillar reported that an allowlisted git show invocation could use its output option to write attacker-controlled configuration, after which a later git diff could invoke an external diff tool with the user's privileges. The issue was patched in Codex CLI v0.95.0 in February, according to the researchers. The lesson is broader than that fixed path: command names are too coarse to express execution safety.

Model refusal cannot close a deterministic gap

Pillar also records a useful disclosure detail: an early reproduction attempt failed because the model refused the injected instruction. That did not make the control effective. A probabilistic refusal sits above the deterministic boundary and can vary between runs; containment has to remain safe when the model complies with hostile input.

This is why prompt-injection testing alone is insufficient for agent security reviews. The review has to enumerate every transition from agent-controlled data to host-side interpretation: project configuration, hooks, build tasks, virtual environments, Git configuration, language servers, package tooling and local service sockets.

Test the execution graph, not the box

Enterprise controls should begin with deny-by-default host interfaces. Remove complex binaries from safe-command lists unless exact argument semantics are constrained. Treat executable project configuration as privileged input. Block agent access to host daemons unless the task requires it, and mediate required services through narrowly scoped interfaces rather than raw sockets.

The acceptance test should then follow the data. Give the agent hostile workspace content and verify that every file it can modify remains inert outside its isolation boundary, every approved command stays within its intended side effects, and every reachable daemon enforces an independent policy. A green sandbox test proves process isolation. It does not prove agent isolation.

Written by the Devence Lab research team.