Agent can bypass sandbox when combining `--sandbox` with `--dangerously-skip-permissions`

[danielmewes]

Reproduction step:

mkdir /tmp/workspace
cd /tmp/workspace
agy --sandbox --dangerously-skip-permissions -p "Run 'echo test > /tmp/outside_workspace.txt'"
cat /tmp/outside_workspace.txt

What I expect: Due to the sandbox, the agent and any terminal command it runs should be unable to write outside of its workspace.

What actually happens: The initial bash tool call fails, but with a hint to the model to pass bypassSandbox: true. The model then follows this suggestion, and successfully runs the command that writes outside the workspace.

The issue appears to be that --dangerously-skip-permissions does not only auto-approve "regular" permission requests, but also auto-approves the prompt for whether the agent is allowed to bypass the sandbox.

This is very unexpected. With Gemini CLI, it was common to combine --yolo with --sandbox to get the safety of the sandbox, without having to worry about permissions.
Other harnesses, such as Claude Code, also work as expected when combining --dangerously-skip-permissions with their respective sandboxing flags, when configured correctly.

With Antigravity CLI, --dangerously-skip-permissions appears to make --sandbox completely ineffective.

IMO this is a pretty major security issue, since it's quite unexpected and a regression from Gemini CLI (at least it was unexpected to me).

Proposed fix: Disallow bypassSandbox without explicit user confirmation, even when --dangerously-skip-permissions is enabled. In headless mode (-p), never allow bypassSandbox.

[IgorGanapolsky]

Hit this same --dangerously-skip-permissions + --sandbox interaction in production yesterday — agent ran for a while and triggered an iPhone Simulator boot loop that pushed my Mac to load avg 307 (256+ simruntime procs, hard-reboot territory). The bypass made it possible for the agent to spawn child processes that nothing reaped.

Stopgap I'm using until this lands properly in the CLI: a runtime wrapper around agy that enforces a singleton lock, a hard timeout, and a stuck-loop watchdog (kills the agent if it stays >80% CPU for 2 min), plus a LaunchAgent that culls runaway simulators independently. MIT, no telemetry, idempotent install:

https://github.com/IgorGanapolsky/mac-yolo-safeguards

It does not fix the underlying sandbox bypass — that has to be addressed in the CLI per the OP's proposed fix — but it caps the blast radius (and never auto-quits foreground GUI apps, which an aggressive killer would). Sharing in case it's useful to anyone else hitting this between now and a fix.