Vince: Okay, this one feels very now. If you’re asking a tool to write files for you and then the rest of your stack trusts those files, that’s not a tiny bug. That’s the whole product boundary getting weird.
Ava: Right. The report’s basically saying researchers escaped the sandbox in Cursor, Codex, Gemini CLI, and Antigravity by getting the agent to write files that host tools later ran. So the failure isn’t some sci-fi model jailbreak. It’s ordinary workflow trust, which is worse in a way.
Vince: Yeah, because that’s the part people actually ship. Nobody buys the demo because they want a sandbox diagram. They buy it because the agent can touch files, move faster, and cut out ten annoying steps.
Ava: Exactly. And once the host side starts treating generated output like local code, the sandbox is only as strong as the next tool in the chain. That’s a very boring sentence, but it’s the whole story.
Vince: How are you doing, by the way? You looked like you were about to argue with a folder structure.
Ava: I’m fine. Slightly offended on behalf of every tool that thought a text file was harmless. Also, this is such an Exploring Next problem. We spend half our lives pretending the edges are clean.
Vince: Ha! Yeah, and then reality shows up with a wrench. I do think the user story is still real, though. People want the agent to draft, edit, and hand off work without babysitting every click.
Ava: Mm-hm. The catch is that “hand off” is exactly where the attack surface lives. If a trusted host command later consumes what the agent wrote, you need a much tighter policy than just “the model is in a sandbox.”
Vince: And that’s the product pain. If the fix makes the tool too fussy, people bounce. If it stays loose, you get a nice demo and a security incident. Delightful little range of options there.
Ava: No way. That’s the whole trade-off. The clever part is that these systems are useful precisely because they cross boundaries. The questionable part is that the boundary crossing is where you’d like some actual discipline.
Vince: Okay, zooming out for a second, this is the same weird race as Cursor, Codex, Gemini CLI, and Antigravity all trying to own the agent layer at once. And meanwhile the boring safety layer is still catching up, which is extremely on brand for twenty twenty-six.
Ava: Yeah, and it’s not abstract. The category is moving fast enough that sandboxing is becoming a differentiator, not a footnote. If you can’t explain the trust chain, you don’t really have an agent product yet.
Vince: Which is exactly why this matters to actual users, not just security people. If the tool can’t survive the first real workflow, the adoption path gets ugly fast.
Ava: Mm-hm. And I like the tools, annoyingly. I just don’t like pretending the file system is a harmless little side quest.
Vince: That is such an Ava sentence. Also, rude to the file system, honestly.
Ava: It earned it.
Vince: Fair. Okay, I’m going to stop you before you invent a second sandbox just out of spite. Good episode, Ava.