Write-Then-Trusted

The seam where sandboxed agents escape without breaking anything: the agent writes a file it is fully permitted to write, and an unsandboxed host component later runs, loads, scans, or trusts it — so confining the agent *process* does not confine the agent. Pillar Security's eight reproduced escapes across Cursor, Codex CLI, Gemini CLI and Antigravity (CVE-2026-48124, GHSA-v4xv-rqh3-w9mc, GHSA-p9g2-cr55-cw9c, fixes in Cursor 3.0.0 / Codex CLI 0.95.0) anchor four failure modes — denylist sandboxes, workspace config that is really code, allowlists trusting command names not invocations, and privileged local daemons outside the box