Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes

Security researchers at Pillar Security broke out of the sandboxes in four widely used AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — by having the agent write a file that a trusted tool outside the sandbox later runs, loads or scans. The seven findings, published as the Week of Sandbox Escapes, include prompt injection triggers and four failure modes; most issues are patched, with Cursor fixing bugs in version 3.0.0 and Codex CLI patched in v0.95.0, while Google downgraded two Antigravity findings as difficult to exploit.

Security researchers broke out of the sandboxes in four widely used AI coding agents, including Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity, without attacking the sandbox head-on. The agent stays inside the box and follows every rule. It just writes a file that a trusted tool outside the box later runs, loads, or scans, and the escape happens on its own. How the escapes work Pillar Security's research team, Eilon Cohen, Dan Lisichkin and Ariel Fogel, reproduced the bypasses over several months and published them today as a series they call the Week of Sandbox Escapes https://www.pillar.security/blog/the-week-of-sandbox-escapes , one write-up a day. These sandboxes draw a simple line: the agent is trusted inside the project workspace, the host outside is protected. The catch is that files inside the workspace are not inert. Tools running outside the sandbox read and act on them, so a file the agent is allowed to write can turn into a command the host later runs. IDEs and CLI agents constantly run their own tools outside the sandbox: Python extensions resolving interpreters, Git integrations scanning repos, VS Code running task files, hook engines firing commands, Docker Desktop exposing a local socket. A sandboxed agent can obey every rule it is given and still shape the files those components read. Prompt injection is the trigger. A malicious instruction planted in a README, an issue, a dependency or a diff becomes a local action on the developer's machine. Pillar sorts the seven findings into four failure modes: - denylist sandboxes that cannot keep pace with the operating system - workspace config that is really executable code - "safe" command allowlists that trust a command's name rather than its arguments, and - privileged local daemons that sit outside the sandbox entirely. The bugs, and the fixes Most of the issues are patched and vendor-acknowledged. In Cursor, a workspace-controlled .claude hook config turned into unsandboxed command execution. It is now tracked as CVE-2026-48124 https://github.com/cursor/cursor/security/advisories/GHSA-pc9j-3qc2-95wv and was fixed in version 3.0.0. A second Cursor bug https://github.com/cursor/cursor/security/advisories/GHSA-p9g2-cr55-cw9c let the agent edit a virtualenv interpreter that the editor's Python extension then ran on its own during discovery. A third abused the fact that Git metadata does not have to live in a folder called .git, firing execution through fsmonitor and slipping past Cursor's path-based rules. It was patched in 3.0.0, with a CVE pending. In Codex CLI, a "safe" command allowlist trusted git show by name while the actual invocation was not read-only. OpenAI patched it in v0.95.0 and paid a high-severity bounty, with a CVE pending. One Docker socket finding hit Codex, Cursor and Gemini CLI https://github.com/cursor/cursor/security/advisories/GHSA-v4xv-rqh3-w9mc at once. A privileged local daemon the agents could reach became an unsandboxed place to run code. That issue is now fixed. Google downgrades its two Google's response to the two Antigravity findings, a macOS Seatbelt denylist bypass and a .vscode task-config bypass of its Secure Mode, was cooler. According to Pillar, Google classified both as "Other valid security vulnerabilities" and applied a downgrade, judging them difficult to exploit because they need social engineering or a user trusting a repository that carries an indirect prompt injection. Pillar says, however, Google's team still rated the work highly, quoting feedback that one report was "of exceptional quality." An old problem, a wider one The underlying class is not new. In April, Cymulate documented https://cymulate.com/blog/the-race-to-ship-ai-tools-left-security-behind-part-1-sandbox-escape/ the same pattern, which it named "Configuration-Based Sandbox Escape," across Claude Code, Gemini CLI and Codex CLI, where a file written inside the sandbox runs on the host at the next launch. What is new is the breadth. The same failure shows up across four tools from three vendors. Pillar's fix is not another list of banned filenames. It watches the moment a trusted local tool runs something the agent wrote. For anyone weighing agentic coding tools, that is the more useful signal: not whether an agent has a sandbox, but what happens to the files it leaves behind. Test every layer before attackers do https://hubs.li/Q04jQ9z40 Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen. The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper https://hubs.li/Q04jQ9z40