The Sandbox Around Your Coding Assistant Is Leakier Than It Looks
Three separate research groups showed last week that Claude Code, Codex, Cursor and others can be made to run attacker code outside their protected workspace, often through ordinary config files. One vendor fix took about 50 days.
If you let an AI assistant run commands on your computer, the thing keeping you safe is a sandbox: a fenced off area where the agent can read, write and execute without touching the rest of your machine. Last week three separate groups published work showing that the fence has gaps, and that getting out of it often does not require anything clever.
The most quietly damning report came from Accomplish, a stealth startup founded by Or Hiltch, Amit Avner and Guy Zipori, which flagged leaky sandboxes in Claude Code, OpenAI Codex and Cursor to the vendors over the summer. Cursor and OpenAI shipped fixes in roughly a week. Anthropic, by Accomplish’s account, took about 50 days and 30 releases. Separately, researchers at Cymulate described a pattern they call configuration based sandbox escape, affecting Cursor, Codex CLI, Gemini CLI and Antigravity: the attack does not break the sandbox wall at all, it has the agent write an ordinary config file that some trusted program on your computer reads and acts on later, outside the fence. One case in Cursor, tracked as CVE-2026-48124, was fixed in version 3.0.0; four of the reported issues were still unpatched when the researchers retested on 1 September. A third group, Manifold Security, showed that simply opening an untrusted repository can be enough, because a malicious .git config file can get Claude Code, Codex, Cursor and Grok to execute attacker chosen commands.
What is behind this
The common thread is that a sandbox only contains what runs inside it. An agent that is allowed to write files is allowed to leave instructions for programs that are not sandboxed at all: your shell, your editor, your version control tool. The agent never escapes. Its homework does. That is an old category of bug, and it is showing up now because coding agents were shipped fast into a job that is unusually dangerous, running arbitrary commands on a developer’s laptop where the credentials live. The 50 day patch gap is the part worth noting for buyers: security marketing and security response are different departments, and only one of them shows up in a benchmark.
What this means for you: If you use Claude Code, Codex, Cursor or a similar agent, update it today, and make updating it a habit rather than an event. Beyond that, one rule covers most of this: do not point a coding agent at a repository you did not write or do not trust, and be suspicious of “just clone this and let the agent take a look.” If you work with anything sensitive on the same machine, keep the agent in a separate container or virtual machine, or at minimum in an account that cannot read your production credentials. If you do not code at all, there is still something here for you: sandboxed does not mean harmless, and any AI tool allowed to write files on your computer deserves the same suspicion you would give a browser extension.
Sources
Source: https://www.upstartsmedia.com/p/accomplish-claims-leaky-sandboxes-in-claude-codex-cursor
One Attacker, Hundreds of AI Agents, 395 Organisations Breached in Days
GreyNoise documented a campaign in which a single threat actor used hundreds of AI agents to exploit two PaperCut print server flaws, compromising 440 servers at 395 organisations in 48 countries. At peak the agents broke into 11 organisations in 26 seconds.
