Cursor, Codex, Gemini CLI, Antigravity: sandbox escapes
Pillar Security walks the same file out of the sandbox in four AI coding agents — each time by getting a trusted host tool to run what the agent wrote.
Loop The sandbox around an AI coding agent, on the machine you actually run the CLI on, is a shell. The agent process runs inside it; the child processes it spawns inherit its filesystem allowlist and its network posture; the rules that block a curl to an attacker host block the agent’s curl to that host for the same reason. That is the physical layer of what “sandbox” means here — not a virtual machine, not a container in the general sense, a scoped subprocess.
The escape Pillar Security published today across Cursor, OpenAI Codex CLI, Google Gemini CLI, and Google Antigravity never leaves that shell. The agent, inside the sandbox, writes a file the sandbox permits it to write — a hook config, a git helper, a virtualenv interpreter, a workspace task, a Docker socket call. A trusted tool outside the sandbox reads that file later, in a context that has none of the sandbox’s constraints, and runs what’s in it. The agent obeyed every rule. Nothing broke out of anywhere. The isolation just didn’t extend past the moment the host tool re-opened the workspace.
The vectors, briefly
Pillar’s writeup — the researchers are Eilon Cohen, Dan Lisichkin, and Ariel Fogel — titles the series “Week of Sandbox Escapes” and works through six distinct instances of the same pattern:
- A workspace-local hook config the agent wrote and Cursor loaded on the next invocation from outside the sandbox.
- A Git
fsmonitordaemon whose path, sitting in tracked repository state, bypassed the sandbox’s path allowlist because Git launched it from a trusted context. - A virtualenv Python interpreter shim that the agent replaced inside the sandbox and that ran on any subsequent editor-extension task that invoked
python. - A workspace
.vscode/tasks.jsonthat ran on the next editor open. - A local Docker socket exposed to the sandbox for legitimate reasons — a general-purpose escape as soon as an agent can address it.
- A macOS Seatbelt denylist bypass in Antigravity: same pattern, different sandbox implementation.
Cymulate documented the same shape back in April 2026 across Claude Code, Gemini CLI, and Codex CLI, calling it “Configuration-Based Sandbox Escape.” Pillar’s contribution is six more of them in tools that had already been notified and had already shipped hardening. That is what tells you the design assumption is wrong, not the individual bugs.
Patches and vendor posture
- Cursor — the
.claudehook config bug is CVE-2026-48124, fixed in v3.0.0. A third Cursor CVE covering a Git-metadata bypass is pending assignment. - OpenAI Codex CLI — the
git showallowlist bypass is fixed in v0.95.0; OpenAI paid a high-severity bounty on the finding. - Google Gemini CLI — patched; CVE pending.
- Google Antigravity — two of Pillar’s Antigravity findings were classified by Google as “Other valid security vulnerabilities” and downgraded on the reasoning that the trigger requires “social engineering or a user trusting a repository” containing indirect prompt injection. Google’s team also called the research quality “exceptional.” A downgrade decision on severity classification is a defensible call for a bug tracker; it is not a fix, and defenders should not read it as one.
No in-the-wild exploitation has been reported. This is a coordinated-disclosure release from a research team, not a live incident.
What to change today
Update Cursor to 3.0.0 and Codex CLI to 0.95.0 on any workstation running either. For the tools where a patch is not yet available or a finding was downgraded, the useful adjustment is at the workspace-trust level rather than the agent’s — because that is where the escape actually lands.
If you run any of these agents against a repository you did not write yourself — a third-party PR, an open-source review, a colleague’s untested branch — treat the workspace itself as attack surface. .vscode/, .claude/, virtualenv paths, and repository-tracked git configuration are all things the agent’s sandbox lets it write, and every host tool outside that sandbox — your editor, your git client, your Docker daemon — will read them the next time it needs to. That is the piece to gate on, not the model.
Related coverage from today’s runs of the same pattern in the wild: Trend Micro documenting an eight-node Gemini-CLI-controlled botnet on dental-clinic PCs, and Hugging Face’s disclosure of an autonomous-agent breach on its internal datasets.
Found this useful? Share it.
