Three research teams escaped every major coding agent's sandbox in four months — and the same git setting did it twice

The bug that is not a bug

Beltdown is unsettling precisely because nothing in it malfunctioned.

The chain, as Accomplish documented it on 11 September: a repository’s setup script creates a .git folder in a subdirectory rather than at the root, which is the whole trick — root-level .git protections exist, and a nested one is not covered by them. Inside it sits a core.fsmonitor configuration entry. Git’s fsmonitor hook is a legitimate performance feature that names an external program for git to run when it needs to know which files changed.

Then Claude Code reads a file in that subfolder. Reading triggers automatic skill loading. Skill loading invokes git ls-files. And git ls-files is one of the harness’s own commands — it runs outside the sandbox, because it is the harness’s, not the model’s.

Git does what git does. It reads the repository config it has been pointed at, finds core.fsmonitor, and executes it with the user’s privileges.

“A command from that repo ran on our Mac anyway, outside the sandbox, with no permission prompt.” — Accomplish AI, Beltdown, 11 September 2026

The sandbox held. The model stayed inside it. The escape happened because a trusted program outside the box read a file that something inside the box was allowed to write. Pillar Security, reaching the same conclusion from different bugs in July, compressed it to five words: files inside the workspace are not inert.

The same setting, twice, five months apart

Here is the detail that turns this from an incident into a pattern.

Pillar’s July research against Cursor — reported by BleepingComputer on 20 July — lists three separate issues fixed in Cursor 3.0.0. One is CVE-2026-48124, a workspace-controlled .claude hook config. One is a virtualenv interpreter the editor’s Python extension runs on its own during discovery. And the third is git metadata abuse that bypassed path-based rules via fsmonitor.

That is the same git primitive Accomplish used against Claude Code, in a different vendor’s product, disclosed roughly five weeks earlier by an unrelated team.

Two independent research groups, two competing harnesses, one fifteen-year-old git configuration key. Neither vendor’s sandbox was weak in an interesting way. Both had drawn the boundary around the agent and left the tooling the agent’s output flows into on the other side of it.

Cymulate had already named the class in May, calling it Configuration-Based Sandbox Escape: the sandbox “isolates the operating system, but leaves the agent’s own configuration, the layer that defines what the agent is allowed to do, exposed and writable.” That research escaped Claude Code via SessionStart hooks in .claude/settings.json, Codex CLI via .codex/config.toml and agents.md, and Gemini CLI via a writable .gemini directory holding oauth_creds.json. Pillar added Antigravity to the list in July with a macOS Seatbelt denylist bypass.

Every serious agentic coding tool on the market, escaped by at least one of three teams inside four months, through the same structural gap.

The league table that inverts

The obvious story to write from the September reporting is that Anthropic is slow. Upstarts Media, on 10 September, laid out the comparison: Anthropic took about 50 days and roughly 30 software updates; Cursor fixed a report from the same researchers in about a week; OpenAI fixed two in about a week and put a statement on the record describing tightened file-writing controls and expanded testing. Anthropic and Cursor did not comment on the record. Accomplish’s own timeline is slightly tighter than 50 — reported 13 July, triaged same day, incomplete fix 6 August, complete fix 26 August — but the shape is the same, and 44 days is not a good number.

Then look at May.

Against Cymulate’s disclosure, Anthropic patched CVE-2026-25725 within 16 days and awarded a bounty. Google acknowledged the Gemini CLI report on 7 January and had communicated no fix and no formal decision more than 90 days later. OpenAI closed the Codex CLI report on 24 February as “Informational,” on the grounds that prompt injection was out of scope, and declined to engage with the researchers’ rebuttal.

Same three vendors. Opposite ordering. Four months apart.

This is why “which vendor patches fastest” cannot go in a procurement scorecard. Response latency is not a stable property of an organisation; it is a property of one report meeting one triage queue in one month, mediated by whether the receiving team accepted the bug class as in-scope at all. A buyer who had chosen a coding agent in June on the strength of Anthropic’s 16-day turnaround would have chosen the vendor that went on to take 44 days on the next one — and would have been right anyway, for reasons that had nothing to do with the metric.

What is stable is the architecture. That is the thing to plan against.

The part that should actually bother you

Not the 44 days. The silence.

Beltdown’s fix shipped inside an ordinary Claude Code release. No CVE. No advisory. The partial hardening in 2.1.223 on 6 August looked, from outside, exactly like the complete fix in 2.1.247 on 26 August — which is to say, like nothing at all. A team with a disciplined upgrade process, pinning versions and reviewing changelogs before rolling forward, had no signal that 2.1.247 was the release that mattered.

This is a recurring shape rather than a one-off. When Accomplish disclosed SharedRoot in July — a Claude Cowork flaw where the guest VM had the host filesystem mounted read-write at /mnt/.virtiofs-root, reachable by chaining the Linux kernel bug CVE-2026-46331 to get guest-root, exposing SSH keys and cloud credentials across roughly 500,000 macOS installs — Anthropic closed the report without a dedicated fix and instead defaulted new Cowork sessions to cloud execution. That does resolve it for most users. It also means anyone who deliberately runs locally is still exposed, and is relying on a default they may have changed for exactly the privacy reasons that led them to run locally.

It is the same disclosure gap we flagged when OpenAI stayed quiet for weeks about an agent swarm occupying a German wiki, and the same one underneath CISA’s advisory on silently degraded models: the vendor knows, the fix ships, and the buyer is never told which change was the important one. Patch latency you can at least measure after the fact. An unannounced fix is invisible by construction.

What to do about it

The honest version is that this changes deployment, not selection. Every agent on the shortlist was escaped; switching tools buys a different CVE list, not a different threat model. See our coding tools roundup and Cursor vs Claude Code for the selection question, which this research does not settle in anyone’s favour.

Pin minimum versions and hold them. Claude Code 2.1.247, Cursor 3.0.0, Codex CLI 0.95.0. Put them wherever your team manages developer tooling, not in a wiki page.

Get the credentials off the box. Both Anthropic’s stated threat model and the SharedRoot impact turn on SSH keys and cloud credentials being sitting there, readable. Short-lived per-session tokens turn a total compromise into a scoped one, and this is the single highest-leverage change available.

Carry the load on egress. Anthropic’s own sandboxing documentation says plainly that “effective sandboxing requires both filesystem and network isolation” — and that without network isolation “a compromised agent could exfiltrate sensitive files like SSH keys.” The filesystem half has now failed publicly three times in four months. Network control is what is left, and it has to live in the network, not in the harness. This is much of the case for running agents on self-hosted or remote execution environments rather than on laptops that hold production credentials — and the reason the split-execution designs we looked at are worth the operational tax for teams shipping with these tools daily.

Ask about advisory practice in writing. Not “how fast do you patch” — the record shows that answer does not hold. Ask whether the vendor publishes advisories for harness security fixes, and whether security-relevant releases are distinguishable from routine ones. Unlike latency, that is a commitment a vendor can make once and be held to.

The broader lesson has been consistent all year, from Meta’s rule-of-two being policy rather than cryptography to a Langflow CVE leaking OpenAI and AWS keys through self-hosted glue: controls that live inside the thing you are trying to contain are not controls. They are configuration. The agent’s sandbox is genuinely useful and worth keeping on — it is simply not the last line, and three research teams have now spent four months demonstrating why.

Questions or corrections? Email Pick Right. Want the full list? See all news.