Security researchers have identified multiple sandbox escape vulnerabilities across four prominent AI coding agents: Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity. The vulnerabilities, discovered by Pillar Security's research team, Eilon Cohen, Dan Lisichkin, and Ariel Fogel, do not involve direct attacks on the sandboxes themselves. Instead, the sandboxed agents manipulate files within their allowed workspace, which are then trusted and executed by tools operating outside the sandbox, leading to code execution on the host machine.
The researchers categorized their seven findings into four primary failure modes: denylist sandboxes unable to keep pace with operating system changes, workspace configurations that are effectively executable code, "safe" command allowlists that trust command names without validating arguments, and privileged local daemons accessible to the agents from outside the sandbox. The trigger for these escapes is often a prompt injection, where a malicious instruction is embedded in a file like a README, an issue tracker, a dependency, or a code diff, which then leads to local action on the developer's machine.
Many of these issues have been acknowledged and patched by the respective vendors. In Cursor, a vulnerability involving a workspace-controlled `.claude` hook configuration allowed for unsandboxed command execution. This issue, tracked as CVE-2026-48124, was addressed in Cursor version 3.0.0. Another Cursor bug allowed an agent to modify a virtual environment interpreter, which was subsequently executed by the editor's Python extension during discovery. A third Cursor vulnerability exploited the flexibility of Git metadata, allowing execution through `fsmonitor` and bypassing path-based rules. Both of these latter Cursor issues were also patched in version 3.0.0, with CVEs pending.
OpenAI's Codex CLI was affected by a "safe" command allowlist flaw, where the `git show` command was trusted by name, despite its actual invocation not being read-only. OpenAI patched this in version 0.95.0 and issued a high-severity bounty, with a CVE pending. A single Docker socket vulnerability impacted Codex, Cursor, and Gemini CLI simultaneously, allowing agents to leverage a privileged local daemon for unsandboxed code execution. This particular issue has also been fixed.
Google's response to two findings in Antigravity, which included a macOS Seatbelt denylist bypass and a `.vscode` task-config bypass of its Secure Mode, was described as more reserved. Pillar Security reported that Google classified these as "Other valid security vulnerabilities," downgrading their severity due to perceived difficulty of exploitation, often requiring social engineering or user trust in a repository containing an indirect prompt injection. Despite this, Google's team reportedly praised the quality of the research.
This class of vulnerability is not entirely new. In April, a similar pattern, termed "Configuration-Based Sandbox Escape," was documented by Cymulate across Claude Code, Gemini CLI, and Codex CLI, where files written within a sandbox were executed on the host upon subsequent launch. The current research highlights the widespread nature of this problem, affecting multiple tools from different vendors.
The proposed solution from Pillar Security focuses not on an expanded denylist of filenames, but on monitoring the moment a trusted local tool executes something written by the agent. This approach emphasizes the importance of understanding the lifecycle of files created by AI agents and how they interact with the broader development environment.
