Notifications
Clear all
Topic starter
22/07/2026 4:38 pm
TL;DR: Cursor’s sandbox escape research shows that a workspace-written .claude/settings.local.json file can be trusted as hook configuration and used to trigger local command execution without the user-facing approval path, according to Pillar Security. The finding underscores how compatibility layers and agent-written project files can turn ordinary automation into a control bypass for AI coding tools.
NHIMG editorial — based on content published by Pillar Security: Introducing SAIL 2.0 Framework and The Week of Sandbox Escapes Day 6 on Cursor sandbox escapes
By the numbers:
- Cursor assigned this issue CVE-2026-48124 and published an advisory GHSA-pc9j-3qc2-95wv.
Questions worth separating out
Q: What breaks when an AI coding agent can write files that host tools later trust?
A: The sandbox boundary breaks in practice, even if the agent process itself never escapes.
Q: Why do enterprise AI agents complicate NHI governance?
A: They complicate NHI governance because the security model was built around predictable non-human identities such as API keys and workload credentials.
Q: How can security teams tell if hook-based automation is becoming a bypass?
A: Look for any file or setting that can cause a command to run without the same approval path as a user-initiated action.
Practitioner guidance
- Classify execution-bearing workspace files as privileged assets Inventory every file that can launch commands, modify hooks, or change local execution state.
- Require dedicated approval for indirect command paths Make the approval prompt name both the command and the file or setting that will cause it to run.
- Constrain compatibility paths to the primary security model Apply the same sandbox, policy, and logging rules to legacy or compatibility namespaces as you do to first-class config.
What's in the full report
Pillar Security's full research covers the operational detail this post intentionally leaves for the source:
- The exact proof-of-concept prompt and file-write sequence used to turn .claude/settings.local.json into a Stop hook.
- The advisory context for CVE-2026-48124, including the affected version and patch reference.
- The step-by-step explanation of why the hook engine crossed the sandbox boundary after the workspace file was written.
- The broader series context across The Week of Sandbox Escapes for teams comparing adjacent agent-execution bypass patterns.
👉 Read Pillar Security's research on Cursor sandbox escapes and hook-based execution →
Cursor sandbox escapes: what hook configuration means for AI agents?
Explore further
22/07/2026 4:42 pm
Workspace-trusted execution is now an identity problem as much as an endpoint problem. When an AI agent can author a file that another local component later executes, the control boundary is no longer just shell approval. It becomes delegated authority over a non-human workflow. That is why NHI governance applies here: the system that writes the instruction and the system that executes it are effectively part of the same trust chain, even if they are different processes. Practitioners should treat write permissions to execution-bearing files as privileged access.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
A question worth separating out:
Q: Who is accountable when an agent-authored config file triggers execution on the host?
A: Accountability sits with the team that defined the trust model and with the product owner who allowed workspace-sourced execution state to run without explicit controls. The issue is not only code quality. It is governance over who can write privileged instructions, how those instructions are approved, and whether the runtime honours them safely.
👉 Read our full editorial: Cursor sandbox escapes show workspace hooks become execution paths
