Notifications
Clear all
Topic starter
22/07/2026 4:37 pm
TL;DR: AI coding agents running under allow-default macOS sandbox profiles can cross from confined workspace actions into unsandboxed host execution, with Launch Services and filesystem quirks creating escape paths, according to Pillar Security. The lesson is not that sandboxes are useless, but that deny-by-default policy and tighter execution boundaries are the only durable answer.
NHIMG editorial — based on content published by Pillar Security: Introducing SAIL 2.0 Framework and The Week of Sandbox Escapes Day 1
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when AI coding agents run in allow-default sandboxes?
A: Allow-default sandboxes fail because they preserve most host capabilities and rely on deny rules to catch every dangerous path.
Q: Why do AI coding agents complicate host isolation and access control?
A: AI coding agents complicate isolation because they are delegated runtimes that can read, write and execute based on instructions that may be benign or malicious.
Q: What do teams get wrong about sandboxing autonomous AI agents?
A: Teams often confuse containment with trust.
Practitioner guidance
- Replace allow-default sandboxes with deny-default profiles Audit every AI coding agent that runs locally and remove broad allow rules for file, process, launch and mount operations.
- Block launch paths that can bypass provenance metadata Review whether the agent can invoke Launch Services, open bundles or interact with filesystem types that do not preserve extended attributes.
- Treat AI coding agents as delegated identities Assign ownership, approval and monitoring to the agent runtime just as you would for a service account or privileged workload.
What's in the full report
Pillar Security's full blog covers the exploitation steps and sandbox profile details this post intentionally leaves at a governance level:
- The exact sandbox-exec profile structure and the allow-default choice that created the escape surface
- Step-by-step macOS launch chain details showing how Launch Services and provenance handling were bypassed
- The full proof-of-concept workflow for mounting, bundle construction and payload execution
- The operational preconditions that make the bypass work in a real developer environment
👉 Read Pillar Security's analysis of sandbox escapes in AI coding agents →
Sandbox escapes in AI coding agents: are your controls keeping up?
Explore further
22/07/2026 4:41 pm
AI coding agents have become a non-human identity problem, not just an application-security problem. Once an agent can read files, launch processes and touch the local environment, it is exercising delegated privilege in ways that should be governed like any other NHI. The issue is not whether the model is clever enough to exploit the host, but whether the runtime boundary prevents that delegation from becoming uncontrolled execution. Practitioners should treat the agent process as an identity-bearing workload with a blast radius, not as a simple tool extension.
A question worth separating out:
Q: Who is accountable when an AI agent escapes its sandbox?
A: Accountability should sit with the team that owns the agent runtime, its permissions and its exception process. If a sandbox escapes, the failure is usually not one line of code but a control design decision that allowed excessive privilege, weak confinement or incomplete validation. That is a governance issue, not only an engineering issue.
👉 Read our full editorial: AI coding agents on shared-host sandboxes create escape risk
