Pillar Security Researchers: AI Coding Agent Sandboxes Isolate the Host, Not the Sandbox Itself
In an analysis published in February 2026, Pillar Security researchers Eilon Cohen and Ariel Fogel noted that while container, gVisor, microVM, and kernel capabilities represent four isolation tiers with distinct failure modes, security is ultimately determined by what is mounted inside the sandbox rather than the strength of the isolation. Using Cursor's CVE-2026-22708 as an example, they demonstrated that static allowlists fail once the environment is poisoned, and granting full filesystem read access allows credentials to be exfiltrated via standard output, even if write permissions are restricted.
When local AI coding agents execute code on a user's machine, they typically operate with user-level privileges: access to the file system, network capabilities, and shell execution. In an analysis published in February 2026, Pillar Security researchers Eilon Cohen and Ariel Fogel summarized this dynamic with a core distinction: isolation technologies protect the host from code running inside the sandbox, but they do not protect the sandbox itself.
This means the sandbox is a containment measure, not a prevention measure. When trust is violated, the sandbox limits the blast radius, but it does not address the underlying trust issue. AI agents process content from sources that cannot be fully verified—model weights that execute code upon loading, package dependencies that include installation scripts, and user-provided repositories—each representing an injection vector. The sandbox is the last line of defense, not the first.
The authors analyzed fourteen sandbox solutions designed for coding agents, categorizing them into four isolation tiers. Containers share the host kernel, meaning a kernel vulnerability can breach the boundary; gVisor intercepts system calls to reduce the attack surface, but its own correctness becomes security-critical; hardware-virtualized microVMs provide an independent kernel for each sandbox, offering the strongest isolation but constrained by session limits and boot latency; and kernel capabilities (such as Landlock and Seatbelt) offer no escape path but are limited to local environments and cannot be deployed on multi-tenant platforms.