Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes

Security researchers broke out of the sandboxes in four widely used AI coding agents, including Cursor, OpenAI’s Codex, Google’s Gemini CLI and Antigravity, without attacking the sandbox head-on.

The agent stays inside the box and follows every rule. It just writes a file that a trusted tool outside the box later runs, loads, or scans, and the escape happens on its own.

How the escapes work

Pillar Security’s research team, Eilon Cohen, Dan Lisichkin and Ariel Fogel, reproduced the bypasses over several months and published them today as a series they call the Week of Sandbox Escapes, one write-up a day.

These sandboxes draw a simple line: the agent is trusted inside the project workspace, the host outside is protected.

The catch is that files inside the workspace are not inert. Tools running outside the sandbox read and act on them, so a file the agent is allowed to write can turn into a command the host later runs.

IDEs and CLI agents constantly run their own tools outside the sandbox: Python extensions resolving interpreters, Git integrations scanning repos, VS Code running task files, hook engines firing commands, Docker Desktop exposing a local socket.

A sandboxed agent can obey every rule it is given and still shape the files those components read.

Prompt injection is the trigger. A malicious instruction planted in a README, an issue, a dependency or a diff becomes a local action on the developer’s machine.

Pillar sorts the seven findings into four failure modes:

• denylist sandboxes that cannot keep pace with the operating system
• workspace config that is really executable code
• “safe” command allowlists that trust a command’s name rather than its arguments, and
• privileged local daemons that sit outside the sandbox entirely.

The bugs, and the fixes

Most of the issues are patched and vendor-acknowledged.

In Cursor, a workspace-controlled .claude hook config turned into unsandboxed command execution. It is now tracked as CVE-2026-48124 and was fixed in version 3.0.0.

A second Cursor bug let the agent edit a virtualenv interpreter that the editor’s Python extension then ran on its own during discovery.

A third abused the fact that Git metadata does not have to live in a folder called .git, firing execution through fsmonitor and slipping past Cursor’s path-based rules. It was patched in 3.0.0, with a CVE pending.

In Codex CLI, a “safe” command allowlist trusted git show by name while the actual invocation was not read-only. OpenAI patched it in v0.95.0 and paid a high-severity bounty, with a CVE pending.

One Docker socket finding hit Codex, Cursor and Gemini CLI at once. A privileged local daemon the agents could reach became an unsandboxed place to run code. That issue is now fixed.

Google downgrades its two

Google’s response to the two Antigravity findings, a macOS Seatbelt denylist bypass and a .vscode task-config bypass of its Secure Mode, was cooler.

According to Pillar, Google classified both as “Other valid security vulnerabilities” and applied a downgrade, judging them difficult to exploit because they need social engineering or a user trusting a repository that carries an indirect prompt injection.

Pillar says, however, Google’s team still rated the work highly, quoting feedback that one report was “of exceptional quality.”

An old problem, a wider one

The underlying class is not new. In April, Cymulate documented the same pattern, which it named “Configuration-Based Sandbox Escape,” across Claude Code, Gemini CLI and Codex CLI, where a file written inside the sandbox runs on the host at the next launch.

What is new is the breadth. The same failure shows up across four tools from three vendors, which is the more useful signal for anyone weighing agentic coding tools.

Pillar’s fix is not another list of banned filenames. It watches the moment a trusted local tool runs something the agent wrote.