Notifications
Clear all
Topic starter
22/07/2026 4:37 pm
TL;DR: Codex CLI’s second sandbox escape shows how a supposedly safe git allowlist can be turned into arbitrary file write and remote code execution, because git show --output can overwrite .git/config and trigger attacker-controlled diff tools on the next git diff, according to Pillar Security. The lesson is that deterministic guardrails must constrain invocations, not trust model behaviour or command names.
NHIMG editorial — based on content published by Pillar Security: Introducing SAIL 2.0 Framework and the Week of Sandbox Escapes analysis of Codex CLI
Questions worth separating out
Q: What breaks when AI coding agents rely on command allowlists for safety?
A: Allowlists break when a command’s arguments can change it from harmless to dangerous.
Q: Why do AI agents create new privilege risk for enterprises?
A: AI agents can chain actions across tools, inherit delegated access, and execute at machine speed without a person confirming each step.
Q: What do security teams get wrong about model refusal as a safeguard?
A: They confuse a possible refusal with a reliable control.
Practitioner guidance
- Audit command allowlists for write-capable flags Review every allowlisted developer command for options such as --output, --format, or similar parameters that change a read-only action into file writes or execution triggers.
- Require approval for trust-boundary changes Treat commands that can modify repository state, configuration, or execution hooks as privileged actions even when they appear operationally routine.
- Block indirect execution through config files Prevent AI tools from writing attacker-controlled content into files such as .git/config unless the destination is explicitly scoped and monitored.
What's in the full report
Pillar Security's full research covers the operational detail this post intentionally leaves for the source:
- The exact git flag combination used to turn a trusted read operation into an arbitrary file write.
- The patch logic and version-level remediation guidance for Codex CLI v0.95.0.
- The disclosure timeline, reproduction path, and proof-of-concept behaviour described by the vendor.
- The code examples showing how to block dangerous flags and override external diff execution.
👉 Read Pillar Security's analysis of the Codex CLI sandbox escape and allowlist gap →
Codex CLI sandbox escapes: where allowlists fail in practice?
Explore further
22/07/2026 4:42 pm
Model behaviour is not a control boundary: the article shows that security architecture cannot depend on a model to refuse malicious instructions. Probabilistic refusal is useful for reducing risk, but it does not replace enforcement at the command, file, or runtime identity layer. For AI agent governance, the control must survive when the model complies, because that is the only test that matters.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI agent triggers code execution through a trusted tool?
A: Accountability sits with the team that defined the tool’s trust boundary, approval model, and runtime policy. If a safe path allows file writes or indirect execution, the control design failed. Governance should assign ownership across platform, security, and identity teams so that command scope, file scope, and approval scope are reviewed together.
👉 Read our full editorial: Codex CLI sandbox escapes show why model behaviour is not control
