Pillar Security finds AI coding agents can be hijacked via trusted files in CI/CD pipelines

Pillar Security has published research showing that AI coding agents can be manipulated into acting outside their sandboxes through files they are configured to trust, such as READMEs, code comments, and dependency manifests. The findings, covered by DevOps.com on July 22, demonstrate multiple sandbox-bypass techniques alongside prompt-injection attacks embedded in routine development artifacts. OpenAI, Google, and Cursor have each patched some of the reported vulnerabilities, though Pillar warns that a vendor patch list does not constitute comprehensive protection. The researchers argue that any file an agent reads on its way to generating a response should be treated as part of the attack surface. The work echoes a May report from Cyberhaven Labs noting that AI coding agent adoption is outpacing the security tooling designed to govern it.