Status: patches shipping · update your agents
The coding agents broke out of their sandboxes
Two disclosures landed at once: seven sandbox-escape techniques across four coding agents, and a pre-authentication WordPress remote code execution chain found with a chatbot for the price of lunch. The sandbox is not the boundary you think it is.
01
Summary of findings
| Finding | Vendor | Severity | Status |
|---|---|---|---|
| Pre-auth RCE chainWordPress batch API, SQLi to RCE | WordPress core | Critical | Update & disclosed |
| Git command allowlist bypass"git show" arguments not modeled | Codex CLI | High | v0.95.0 |
| .claude hook & git-metadata executionworkspace config becomes code | Cursor | High | v3.0.0 |
| Docker socket reachable from agentprivileged daemon exposure | Gemini CLI | High | Advisory issued |
| Seatbelt denylist & VSCode task escapesandbox profile bypass | Antigravity | Downgraded | Under review |
Severity and status reflect vendor advisories as of publication. Seven techniques total across the four agents; the rows above group them by vendor.
02
The week of sandbox escapes
ADV-DETAIL · coding agents
Pillar Security published seven ways to escape the sandboxes of Cursor, Codex CLI, Gemini CLI, and Antigravity. The pattern repeats across every one: the agent cannot run a dangerous command directly, so it writes a config file, a git hook, or a virtualenv the host later executes with no sandbox at all. A command allowlist that trusts a name without modeling its arguments is not a boundary.
Cursor fixed the workspace-config and git-metadata paths in 3.0.0 with a CVE and advisories. Codex patched its allowlist bypass in v0.95.0 and paid a bounty. Gemini CLI shipped a fix and an advisory. Google rated the Antigravity findings lower on exploitation difficulty; treat that as unfinished, not safe.
Vectorconfig-file indirection
Impacthost command execution
Fixupgrade all four
03
A $25 model found a WordPress RCE
ADV-DETAIL · WordPress core
Searchlight Cyber's Adam Kues used GPT-5.6 to read WordPress source and surface a pre-authentication remote code execution chain in the batch API present since WordPress 5.6. A desync in that endpoint bypasses sanitization, an unescaped parameter opens a SQL injection, and the post cache and changeset system carry it up to admin and then code execution. Roughly ten hours of model time, about $25 of a $200 weekly subscription, against software running a large share of the web.
The disclosure was coordinated; the researchers held publication over a weekend so sites could update. The lesson for anyone shipping WordPress work is blunt: the same models your clients use to build are now cheap enough to audit at scale, and the brokers who pay half a million for these bugs have the same tools.
Vectorpre-auth batch API
ImpactSQLi to admin to RCE
Cost to find~$25 · ~10 hrs
04
Remediation
- Update your coding agents now. Cursor to 3.0.0 or later, Codex CLI to v0.95.0, Gemini CLI to the advised build. Treat auto-update as the exception this week, not the rule.
- Assume the sandbox leaks. Do not run an agent unattended with host credentials, a live Docker socket, or write access to shell config it can turn into execution.
- Patch WordPress and audit the batch API surface. Apply the core update, and review any custom endpoint that trusts client-supplied query arguments.
- Bring the auditor's tools in-house. If a $25 model can find a pre-auth RCE, point one at your own code before a broker does.
Today's Art Direction: The Security Advisory
A vendor security bulletin: status banner, severity table, remediation steps.
Security advisories are a real, high-trust document type with a rigid grammar: a status banner up top, a metadata block with an advisory ID and date, a severity table with fixed-in versions, per-finding detail cards, and a numbered remediation list. That structure is a genuine web-design pattern for changelogs, incident pages, status sites, and trust centers. Today's page runs it straight in a dark console palette, using severity color as the only ornament and a cracked glass cube as the one image the whole advisory is about.
Status banner
Severity table
Advisory ID
Fixed-in versions
Detail cards
Remediation list
Severity color
Borrow this pattern
Color as severity, not decoration
An advisory earns trust by spending color only where it carries meaning: one warm red for critical, one amber for high, one cool blue for informational, and nothing decorative anywhere else. The reader learns the key in one glance and then scans the table by hue alone. Reuse it for status pages, pricing tiers, test dashboards, any interface where a category needs to be read at a distance. Restraint is the whole discipline: the moment a color appears that is not on the key, the key stops meaning anything and the palette is back to decoration.
05
Prompt Lab
Build a one-page security advisory / trust-center page for a product called [NAME] disclosing [N] findings. Art direction: a dark security console. Ground near-black blue (#101418) with slightly raised panels (#161C22), off-white text (#E6ECF0), muted blue-grey for secondary text (#9FB0BC), 1px slate borders (#28323B). Severity is the ONLY color: warm red (#E8623A) critical, amber (#E0A73C) high, cool blue (#4CA5C4) informational, green (#5FB98C) for resolved. No gradients, no glow, square corners. Type: Space Grotesk (600/700) for the headline and section titles; IBM Plex Sans for body at 19px, 1.65 line height; IBM Plex Mono for the advisory ID, metadata, severity chips, version strings, and table labels. Layout, top to bottom: 1. Top bar: wordmark and two links. 2. Advisory header: a bordered status banner (colored dot plus a short status line), a mono metadata row (advisory ID, issue or version, published date, read time), a large headline, and a one-paragraph deck. 3. A single framed figure: one studio photograph the whole advisory is about, with a mono caption row. 4. Summary table: columns for finding (name plus a mono sub-line), vendor, a bordered severity chip, and a fixed-in status. Row hover only. Make it horizontally scrollable and stack to cards under 760px. 5. Two or more detail sections, alternating panel backgrounds: a mono sub-label, a title, two short paragraphs, and a bordered impact row (vector, impact, fix) in mono. 6. A numbered remediation list using leading-zero counters. Readability guardrails: body at least 18px, WCAG AA contrast for every severity color and mono label on the dark ground, descriptive link text, hover states on rows and links (150ms ease), a reduced-motion media query. No fake terminal text in the image, no neon glow, no matrix-rain cliches; the palette stays disciplined and the severity key stays honest.
Reproducible with Beaver Builder AI, v0, Figma Make, Lovable, or Bolt.
06
Field note
We spent a year handing agents the keys to the workshop. This was the week the receipts came in: the same cheap intelligence that builds your site will, for the price of lunch, find the way in.
07