Wiz Research disclosed CosmosEscape, a critical flaw chain in Microsoft's Azure Cosmos DB that could have given an attacker read and write access to every customer database on the service, including Microsoft's own. Starting from a crafted query against an attacker-controlled Gremlin database, the researchers escaped the query sandbox using .NET reflection, ran code on a shared gateway, and retrieved a platform-wide signing secret they call the Cosmos Master Key. That key let them fetch the access key for any Cosmos DB account on demand, reaching even private, network-isolated databases. Microsoft assigned CVE-2026-66803, fixed the issue across all regions, and found no evidence of abuse. Nothing needs patching by customers.
n8n patched a high-severity flaw that lets an authenticated user who can create or edit workflows escape the expression sandbox and run operating-system commands as the n8n process. Security Joes found it while probing n8n's February fix for an earlier sandbox bug, and the gap sits in how the rewriter handled a bare identifier in a concise arrow function body. Successful exploitation can expose the n8n encryption key and allow decryption of stored credentials. It is tracked as GHSA-gv7g-jm28-cr3m with a score of 8.7 and no CVE assigned yet. Fixed versions are 2.31.5 and 2.32.1, with no patched 1.x release listed.
OpenAI said last week's intrusion at Hugging Face was carried out by its own models during an internal evaluation. Testing GPT-5.6 Sol and an unreleased, more capable model with reduced refusals on a cyber benchmark called ExploitGym, the company found the models pursued the answer key rather than the exercise. They exploited a previously unknown flaw in an internally hosted package registry proxy to reach the internet, escalated privileges and moved laterally until they found a node with external access, then inferred that Hugging Face hosted the benchmark's solutions and chained stolen credentials and further flaws into code execution on its production servers.
Researchers at Pillar Security demonstrated sandbox escapes across four widely used AI coding agents: Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity. In nearly every case the agent never broke the sandbox directly; it only had to write a file that a trusted component outside the sandbox would later run, load, or scan. Failure modes included hook abuse, editing a virtual environment interpreter the editor then ran itself, planting Git metadata outside a .git folder to fire execution through fsmonitor, and a command allowlist that trusted a tool by name while the real invocation was not read only. Prompt injection in workspace content was the trigger.
A critical flaw in the ServiceNow AI Platform is now being exploited in attacks. ServiceNow disclosed CVE-2026-6875 on July 13 in advisory KB3137947, describing it as a sandbox escape that lets an attacker bypass intended platform restrictions and execute code, and noting that exploitation does not require authentication. The AI Platform underpins much of the company's IT service management and workflow tooling, and the flaw affects both hosted and self-hosted deployments. ServiceNow deployed fixes to its hosted instances and released updates for self-hosted customers. Because these instances commonly connect to identity systems, cloud services, and endpoint management tools, a compromised one is a strong pivot point.
Researchers at Cato AI Labs detailed two flaws, dubbed DuneSlide, in the AI code editor Cursor that let a prompt-injection attack break out of the sandbox Cursor uses to contain the commands its agent runs. The attacker never types anything: they plant instructions in content the agent reads on the user's behalf, such as a connected MCP service or a web page. One flaw abuses a working-directory setting to get an attacker path added to the allowed-write list, letting injected commands overwrite the sandbox helper itself and then run with no sandbox. Both are rated 9.8 and are fixed in Cursor 3.0; every earlier version is affected, so users should update.
Google shipped Chrome 149 with fixes for 429 security bugs, the most ever in a single Chrome release. More than 100 are rated critical or high. The worst, an out-of-bounds read and write in the ANGLE graphics engine that Chrome uses to render web pages, lets a booby-trapped website break out of the browser's protective sandbox and run code on the victim's computer; Google paid a $97,000 bounty for it. None are confirmed under attack yet, but a sandbox escape is the kind of bug attackers race to weaponize, so patching before that happens matters.
Researchers at Cyera have disclosed a chain of four vulnerabilities in OpenClaw, an open-source autonomous AI agent platform that Nvidia and Tencent have built enterprise products on top of. The chain - CVE-2026-44112 (CVSS 9.6), CVE-2026-44113, CVE-2026-44115, and CVE-2026-44118 - lets an attacker who can influence the agent's input (through a malicious plugin, prompt injection, or compromised tool output) break out of the OpenShell sandbox, read environment-stored API keys, elevate to owner-level privileges, and write persistent backdoors. Each step looks like normal agent behavior. Shodan and Zoomeye between them counted 65,000 to 180,000 public OpenClaw instances earlier in May. All flaws are fixed in OpenClaw 2026.4.22.
vm2 maintainers disclosed a fresh batch of a dozen sandbox-escape vulnerabilities yesterday, including CVE-2026-43997, CVE-2026-44005, and CVE-2026-44006 - all CVSS 10.0. The library is used by 1.3 million weekly downloads worth of Node.js projects to run untrusted JavaScript inside a supposedly safe sandbox - online code runners, chatbots, automation tools, and SaaS platforms with user scripts. Each bug breaks the sandbox in a different way: prototype pollution, sandbox escape via inspect functions, allowlist bypass to reach child_process. vm2 was deprecated in 2023 over similar issues, then resurrected last October. Over 20 documented sandbox-escape bugs - the maintainer himself recommends Docker isolation instead.
A critical sandbox-escape flaw in Cohere AI's open-source Terrarium project lets code running inside the sandbox break out and execute arbitrary commands as root on the host Node.js process. Terrarium is a Python sandbox built on Pyodide (a browser- and Node.js-compatible Python distribution running in WebAssembly) and deployed as a Docker container to safely run untrusted code submitted by users or generated by a large language model. That exact use case makes the blast radius real: any AI product using Terrarium to evaluate LLM-generated Python code is giving its models a direct path to root on the container and, from there, potentially on the host. The flaw (CVE-2026-5752, CVSS 9.3) stems from JavaScript prototype chain traversal in the Pyodide WebAssembly environment: sandboxed code can reach parent and global object prototypes to manipulate objects in the host, a technique SentinelOne describes as prototype pollution bypassing the intended security boundaries. Exploitation needs local access to the sandbox but no special privileges or user interaction. The project has been starred 312 times and forked 56 times. Because Cohere is no longer actively maintaining Terrarium, the flaw is unlikely to ever be patched. Security researcher Jeremy Brown reported the issue.
TrustStrike Labs