Sandbox Escape
A sandbox escape is when an AI agent breaks out of, or reaches around, the isolated environment meant to contain it, so its code or actions run with access the sandbox was supposed to deny.
What It Is
A sandbox escape is what happens when an AI agent gets its code or its actions to run outside the walled-off space that was supposed to hold it. A sandbox is a deliberately restricted environment: an agent running inside it can read and write only certain files, reach only certain parts of the network, and call only certain commands. The whole point is that if the agent misbehaves, whether from a bug, a bad instruction, or a planted attack, the damage stays inside the box. A sandbox escape is the failure of that promise. The agent, or something acting through it, reaches past the wall and touches the wider system with privileges it was never meant to have.
The term moved to the center of the AI conversation on July 21, 2026, when Pillar Security disclosed seven such vulnerabilities across four coding tools, including Cursor, OpenAI’s Codex CLI, and Google’s Gemini CLI, from three different vendors. The striking part was that the agent rarely broke the wall by force. It wrote an ordinary-looking file, and a trusted program living outside the sandbox later ran, loaded, or scanned that file, doing the escaping on the agent’s behalf.
How It Actually Works
The most dangerous escapes are indirect, and that is what makes them hard to see. The agent stays politely inside its box the entire time. What it does is leave something behind, a configuration file, a script, a git artifact, a hook definition, that a more privileged host tool will later pick up and act on without questioning where it came from. The sandbox contained the agent’s hands; it did not contain the agent’s output, and the output was the weapon.
This is close kin to indirect-prompt-injection, where a hidden instruction rides inside content the agent reads. Here the payload rides inside content the agent writes. In Cursor’s case the escape route was a Claude hooks configuration file (tracked as CVE-2026-48124, fixed in version 3.0.0); in the Codex CLI it was a gap in a git-show command allowlist. Different doors, one pattern: the boundary the agent respected was not the boundary that actually decided what got executed.
Why It Matters Right Now
Sandbox escapes matter now because the whole industry is racing in the opposite direction. Model tiers are being priced and marketed explicitly for agentic work, cheap enough to run autonomous agents everywhere, and the cheaper autonomy gets, the more copies of it end up loose in real systems. Every one of those agents is trusted to stay in its lane, and this week’s disclosures are direct evidence that the lanes leak.
Notably, Google declined to patch some of its own findings, arguing that a sandbox was never the correct containment layer in the first place. Whether or not you agree, the argument concedes the core point: the sandbox alone is not a wall you can lean your full weight on. The agent-control-surface where a human watches and approves is not decoration; it is load-bearing precisely because the automated boundary can fail silently.
The Cost / Tradeoff
The tradeoff is the oldest one in security: containment versus capability. A truly airtight sandbox, no file writes a host tool trusts, no network, no shared configuration, is also a nearly useless agent, because useful agents work by producing files and invoking real tools. Every capability you grant an agent to make it helpful is another surface an escape can travel through. Tighten the box too far and the agent cannot do its job; loosen it for productivity and you widen the escape routes. There is no setting that gives you both, only a position you choose on the dial.
How TWO Uses It
TWO treats a sandbox escape not as an exotic exploit but as the default assumption an operator should hold. The right posture is not “is my agent sandboxed” but “when the sandbox fails, what does it reach?” That reframes the decision: before you turn an agent loose, you decide what lives outside its blast radius, what credentials it can never see, what commands no file it writes could ever trigger. A safety-classifier and a model-jailbreak defense are layers, not guarantees, and layering them is the whole game, because any single layer this week was shown to have a gap.
Scott’s Take: Treat every agent as if the sandbox will fail, because the people who build sandboxes just told you theirs do.
What to Watch Next
The signal to watch is where vendors decide the real containment boundary lives. Google’s refusal to patch at the sandbox layer is an early move in a coming argument: is the right wall the sandbox, the host tool’s trust model, the operating system, or a human approving each privileged action? As agents multiply, expect the industry to shift containment upward, away from “trap the agent in a box” and toward “never let any file the agent writes reach a privileged tool unreviewed.” When you see that language in a release note, the vendor has quietly admitted the box was never enough.