7 posts
We want the agent to work carefully, and instructions are useful for that, but they are not a security boundary. Accomplish gives the agent a complete working environment, while trusted controls outside the sandbox govern its access to anything beyond it.
Two ways out. One lets a patch write anywhere on the disk with no prompt. The other gets unsandboxed command execution out of read-only, the strictest mode Codex has.
Let’s explore what AI agents could do inside your enterprise’s stack
An attacker-controlled workspace/project folder, containing a .git/ directory, can escape the Cursor CLI's macOS sandbox and run code on your Mac with the logged-in user's full authority, no permission prompt, regardless of tool permission mode. The same class of bug as the Claude Code escape (Beltdown), but with no git hardening at all.
Subscribe to our newsletter
By signing up to our newsletter, you agree to our data & privacy policy.
We want the agent to work carefully, and instructions are useful for that, but they are not a security boundary. Accomplish gives the agent a complete working environment, while trusted controls outside the sandbox govern its access to anything beyond it.
Two ways out. One lets a patch write anywhere on the disk with no prompt. The other gets unsandboxed command execution out of read-only, the strictest mode Codex has.
An attacker-controlled workspace/project folder, containing a .git/ directory, can escape the Cursor CLI's macOS sandbox and run code on your Mac with the logged-in user's full authority, no permission prompt, regardless of tool permission mode. The same class of bug as the Claude Code escape (Beltdown), but with no git hardening at all.
