Sandbox escape flaws found in Cursor, Codex, Gemini CLI, and Antigravity
Cybersecurity firm Pillar spent a couple of months probing AI coding agents for sandbox escape paths. They found them in four tools: Cursor, Codex CLI, Gemini CLI, and Antigravity.
How the Attack Works
The attack path is deceptively simple. A threat actor plants malicious instructions inside a repository, buried in something as ordinary as a README file or a dependency. When a developer pulls that repo and runs an AI coding agent on it, the agent follows those instructions and modifies a project configuration file. Nothing triggers an alert because everything happens inside the workspace.
The trap springs when a host component outside the sandbox, such as a Git integration, an IDE extension, or a local daemon, reads that modified config and executes the attacker-written commands. At that point the code runs with the privileges of the trusted host component, not the restricted AI agent. The sandbox boundary is gone.
Pillar put it plainly:
“If an agent gets to write the future inputs of systems, it was never sandboxed in the first place.”
Patch Status by Platform
- Cursor: Patched in version 3.0.0. CVE-2026-48124 assigned (CVSS 8.5, rated High). A second issue tracked via GitHub Security Advisory. Pre-3.0.0 builds could execute workspace-defined hook commands from
.claude/settings.local.jsonwithout user approval. - Codex CLI: Fixed in version 0.95.0. CVE still pending at time of publication.
- Gemini CLI: Affected by a Docker daemon issue, fixed under advisory
GHSA-v4xv-rqh3-w9mc. - Antigravity: Google acknowledged both reported bypasses as valid findings but classified them as “Other valid security vulnerabilities” and downgraded their severity, citing exploitation difficulty.
The Operator Takeaway
If your team uses AI coding agents against external repositories or untrusted codebases, check which version you are running. Cursor users specifically should confirm they are on 3.0.0 or later. The broader point from Pillar is worth internalizing: agentic tools need a distinct threat model from traditional sandboxed software. The boundary assumptions developers are used to do not hold when an agent can write config files that host-level components later execute.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
