The Week of Sandbox Escapes Day 2: One Docker socket to rule them all: escaping Codex, Cursor, and Gemini CLI's sandboxes
ID: cacecbfc-99b0-5142-ae06-a512a3798c1c
STIX ID: report--cacecbfc-99b0-5142-ae06-a512a3798c1c
Feed Name: Pillar Security
**Executive summary:** The report documents a practical sandbox escape against AI coding agents on macOS that use deny-by-default seatbelt profiles by abusing Docker Desktop: an agent with workspace write and network access can import an Alpine rootfs, run a privileged container, and mount VirtioFS to reach and modify the host home directory (e.g., persist a payload in .zshrc). The post includes a reproducible PoC, explains why the sandbox model fails against privileged local daemons, and details differing vendor responses (Cursor patched, Codex deemed informational, Gemini pointed to docs).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.