A stealth startup called Accomplish just reminded us that when AI writes code, the sandbox is the last line of defense. And right now, that line is leaking.
The company, founded by Or Hiltch, Amit Avner, and Guy Zipori, disclosed vulnerabilities across Claude Code, OpenAI Codex, and Cursor after quietly reporting them to vendors this summer. The bugs let AI-generated code escape the sandboxes meant to contain it, a problem that becomes exponentially worse as developers hand more autonomy to AI agents.
The timing matters. OpenAI just opened public beta for its Agents API two days ago, built on a managed Codex harness designed to handle sessions, orchestration, and recovery while developers focus on tools and execution environments. Built-in sandbox execution is supposed to be one of the safety rails. If those sandboxes are porous, the entire trust model breaks.
Accomplish's disclosure is unusually specific: it names the platforms, credits the researchers, and confirms the vendors were notified before going public. That's the responsible path, but it also means these issues were live in production while the industry raced to ship agent-powered coding tools.
What makes this scarier is the trend line. A Russian-speaking threat actor recently used hundreds of AI agents built on OpenAI's Codex and a DeepSeek model to exploit unrelated vulnerabilities, compromising 440 PaperCut instances across 395 organizations in 48 countries. That campaign started in August. The fact that someone can already weaponize AI agents at scale means sandbox escapes aren't theoretical edge cases anymore.
The broader issue is that AI coding tools are being deployed faster than the security assumptions underneath them can be validated. Sandboxes work when the code inside is dumb and predictable. AI-generated code is neither. It's creative, context-aware, and increasingly capable of doing exactly what you didn't anticipate.
Accomplish is still in stealth, so we don't know what they're building or whether they plan to sell a fix. But they've made their point: if you're betting your infrastructure on AI agents that write and run code, you'd better hope the vendors patched fast.