Security researchers have identified AI sandbox escapes affecting four widely used coding agents: Cursor, Codex CLI, Gemini CLI, and Google Antigravity.
The flaws do not necessarily require an attacker to break the sandbox directly. Instead, a sandboxed coding agent can write a file inside a project workspace that a trusted tool on the host system later reads or runs. That interaction can then lead to code execution outside the sandbox.
Pillar Security’s researchers, Eilon Cohen, Dan Lisichkin, and Ariel Fogel, disclosed the findings as part of a series called Week of Sandbox Escapes. Most of the reported issues have been fixed or acknowledged by the affected vendors.
How AI Sandbox Escapes Work
AI coding agents are usually allowed to create and edit files within a project workspace. Meanwhile, the operating system, code editor, and development tools run outside the agent’s sandbox.
This creates a security risk when trusted host-side tools automatically process files that an agent can modify.
For example, an IDE may inspect a Python interpreter, run a workspace task, load a hook configuration, scan Git metadata, or communicate with a local Docker service. If an attacker can convince the agent to create or alter the relevant file, the trusted tool may later execute attacker-controlled code.
The initial trigger can be indirect prompt injection. A malicious instruction could be hidden in a README file, software dependency, pull request, issue, or code diff. The AI agent may then follow that instruction and make a harmful local change.
Pillar Security grouped the findings into four main categories:
- Denylist-based sandboxes that fail to account for operating system behaviour.
- Workspace configuration files that can function as executable code.
- Command allowlists that check a command name but ignore unsafe arguments.
- Privileged local services that agents can access outside the sandbox.
Cursor Bugs Allowed Host-Side Execution
Researchers found three separate issues in Cursor.
One flaw involved a workspace-controlled .claude hook configuration. An attacker could use it to cause unsandboxed command execution. The issue is tracked as CVE-2026-48124 and was fixed in Cursor version 3.0.0.
A second issue allowed an agent to modify a virtual environment interpreter. Cursor’s Python extension could then execute that interpreter automatically while checking the development environment.
The third flaw abused Git metadata stored outside a standard .git folder. This allowed execution through Git’s fsmonitor functionality while bypassing Cursor’s path-based protections. Cursor fixed the issue in version 3.0.0, while a CVE is still pending.
Codex CLI and Shared Docker Socket Issue
In Codex CLI, researchers found that a command allowlist treated git show as safe based on its name alone. However, the full command could be invoked with arguments that were not read-only.
OpenAI fixed the issue in Codex CLI version 0.95.0 and awarded a high-severity bug bounty. A CVE has not yet been assigned.
A separate issue affected Codex, Cursor, and Gemini CLI. The agents could access a Docker socket exposed by a privileged local service, creating a route to execute code outside the sandbox. The vendors have fixed this problem.
Google Downgraded Antigravity Reports
Pillar Security also reported two issues in Google Antigravity.
The first involved a macOS Seatbelt denylist bypass. The second used a .vscode task configuration to bypass Secure Mode protections.
Google classified both reports as valid vulnerabilities but downgraded their severity. The company reportedly considered them difficult to exploit because they rely on social engineering or a developer opening a repository containing an indirect prompt injection.
However, the researchers argue that this trust boundary is exactly where the risk lies. A developer may not realise that an AI agent can change files that trusted local tools later execute.
AI Sandbox Escapes Remain a Wider Security Problem
The underlying issue is not new. Earlier research described configuration-based sandbox escapes in several AI coding tools, where a file created inside a sandbox could run on the host system during a later launch.
The latest findings show that the problem affects multiple products and vendors. For developers, the key question is not simply whether an AI coding agent has a sandbox.
It is whether local tools can safely handle the files that agent writes.
0 responses to “AI Sandbox Escapes Hit Codex, Cursor and Gemini CLI”