Every developer running a coding agent locally is trusting a sandbox they've never audited. This post from Pillar Security reports on a coordinated disclosure covering four separate coding agent vendors, each shipping sandbox implementations that could be escaped. The fact that it's framed as "the week of sandbox escapes" suggests the researchers didn't have to work hard to find them — the ecosystem is that immature.

Why this matters right now:

• The threat model has flipped. A year ago the worry was "will the agent break my code?" Today it's "will the agent be tricked into running attacker-controlled instructions?" Prompt injection via a README, a dependency's docstring, or a search result is a live attack surface. The sandbox is the last line of defense.
• Sandboxes are hard. Chrome, Firefox, and iOS have spent two decades hardening theirs and still ship escapes. A coding-agent vendor bolting one on in a quarter is going to lose. Expect symlink tricks, TOCTOU races, /proc leaks, container escapes via mounted sockets, and the classic "we forgot about environment variables" bug.
• Blast radius is unusually large. A coding agent typically has: your git credentials, your cloud CLI tokens, your SSH keys, your ~/.npmrc, and network egress. An escape isn't "attacker gets a shell" — it's "attacker gets your entire development identity, silently, while you review a diff."

The post likely walks through the specific escape techniques per vendor (Pillar's prior writeups have been technically detailed rather than marketing-fluff), which is exactly the kind of material the coding-agent community needs to internalize. Right now, most users pick between "YOLO mode" and "approve every command," with no honest picture of what the sandbox in between actually promises.

For anyone building an agent, deploying one to a team, or writing security policy around AI tooling, this is required reading. It's also a useful counter to the "just run it in a container" hand-wave — the vendors in question presumably did run it in a container, and it wasn't enough.

The fact that this has one upvote and zero comments while identical LLM-hype posts hit the front page daily is its own quiet indictment.