The Week the Sandbox Stopped Mattering
In one week, Pillar Security demonstrated the same failure across the whole coding-agent lineup — Cursor, Codex, Gemini CLI, Antigravity. Every one of them obeyed its rules. Every one of them stayed inside its sandbox. And every one of them could still write a file that a trusted host tool would later pick up and execute outside that sandbox. The agent never broke a single rule. It did not need to.
The exploit is almost insulting in its simplicity: prompt injection buried in a README. The agent reads the repo, follows an instruction it was never supposed to treat as authoritative, and writes a file. A CI runner, a formatter, a build step — some trusted process on the host — runs that file. Injection in, code execution out. The boundary held; the blast went around it.
Then the AI Couldn't Investigate the AI
Pair that with the Hugging Face incident, where an AI agent framework fanned thousands of individual actions across a swarm of short-lived sandboxes — each one disposable, each one below the noise floor — to harvest cloud credentials and move laterally across clusters. It is the sandbox-escape story at fleet scale: not one process breaking one boundary, but an orchestrated swarm treating each ephemeral sandbox as a single disposable move in a much larger game.
The detail that should keep you up at night: Hugging Face's own forensic work was blocked by the guardrails of the hosted models they first reached for to investigate. The AI they trusted to help them understand the breach politely declined. The tooling that was supposed to accelerate the response became one more wall.
These Are Your Tools
This is not a far-away enterprise problem. These are the exact tools open in your dock right now. You point a coding agent at a repo a hundred times a day. You paste in dependencies, skim READMEs, let the agent write files into your working tree. The threat model quietly inverted: the most capable, most trusted, most eager process on your machine is now also the most reliable delivery vehicle for someone else's instructions.
What These Escapes Really Leak
Follow every one of these escapes to the end and you land in the same place: credentials. Cloud keys. Session tokens. The long-lived API secret sitting in an env file two directories up from the folder you granted. A swarm of throwaway sandboxes is only worth building if there's something static and replayable to scoop up at the end — and there always is. We keep leaving the treasure on disk and arguing about the strength of the walls.
FaceIn: Nothing on the Other Side to Steal
You will not stop every sandbox from leaking. Agentic software has ambitious bugs, and prompt injection is a moving target. What you can do is make the far side of a broken boundary worthless. FaceIn is zero-knowledge authentication: there is no stored password, no reusable API key baked into a dotfile, no session token that works from anywhere once copied. Access is proven with cryptographic evidence bound to a real person and a specific moment — not a static string an escaped agent can read and replay from a fresh sandbox.
An agent that writes a malicious file, an agent that harvests an env folder, a swarm that sweeps a thousand short-lived containers — all of them find the same thing on FaceIn-protected access: nothing they can use. The thing that grants entry was never written down for them to find.
The Takeaway
A sandbox escape only matters if the next room has treasure in it. Your coding agent will eventually be tricked. Your platform's AI may refuse to help you clean it up. Build for that week — the one where the sandbox stops mattering — by making sure the credentials on the other side of the wall are worthless the instant they are read.