Topic starter
22/07/2026 4:37 pm
TL;DR: Codex CLI’s second sandbox escape shows how a supposedly safe git allowlist can be turned into arbitrary file write and remote code execution, because git show --output can overwrite .git/config and trigger attacker-controlled diff tools on the next git diff, according to Pillar Security. The lesson is that deterministic guardrails must constrain invocations, not trust model behaviour or command names.
Editorial analysis by NHI Mgmt Group, based on content published by Pillar Security: “The Week of Sandbox Escapes Day 5: GitPwned: Allowlist to RCE”.
Key questions
Q: What breaks when AI coding agents rely on command allowlists for safety?
A: Allowlists break when a command’s arguments can change it from harmless to dangerous.
Q: Why do command allowlists fail when AI agents can generate arguments?
A: Because the risk sits in the argument space, not only in the command name.
Q: What are the signs that an AI agent conversation is becoming unsafe?
A: Look for repeated reframing, slow escalation toward sensitive actions, probing for tool access, and requests that narrow from a legitimate task into higher-risk operations.
Practitioner guidance
- Harden allowlists around invocations, not binaries Require argument-level inspection for every safe-listed command and block flags that change read-only tools into write-capable tools, especially where AI agents can generate the invocation.
- Remove write access to execution-sensitive config files Prevent agents from writing to files such as .git/config, shell profiles, or tool configuration that can redirect later execution into attacker-controlled code.
- Constrain agent actions with deterministic policy checks Enforce policy on the final system call or file target, so model refusal or prompt classification is never the only thing standing between safe and unsafe behaviour.
Bottom line: This sandbox escape shows that allowlisting a command name is not enough when arguments can turn a read-only tool into a write primitive.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:42 pm
Invocation, not command name, is the control boundary: this case shows that AI agent governance fails when policy stops at the binary name. A non-human actor can still weaponise a permitted command through flags that alter state, so the security model has to evaluate arguments, file targets, and downstream effects. Practitioners should treat invocation analysis as part of agent authorisation, not an optional hardening layer.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: Should organisations trust model refusal to block malicious agent actions?
A: No. Model refusal is probabilistic, so it cannot be treated as a reliable control boundary. Organisations should assume the model will sometimes comply with harmful instructions and design deterministic controls that still prevent harmful writes, privilege changes, and downstream execution.
👉 Read our full editorial: Codex CLI sandbox escapes show why model behaviour is not control