Cursor, Codex, Gemini CLI, Antigravity Attacked by Sandbox Escapes

Table of Contents

Safety researchers have breached the sandbox with out attacking it head-on with 4 extensively used AI coding brokers, together with Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity.

Brokers keep within the field and observe all guidelines. Simply write the file, after which your trusted out-of-the-box instruments will run, load, or scan it, and the escaping will occur routinely.

Escape mechanism

Pillar Safety’s analysis staff, Eilon Cohen, Dan Lisichkin, and Ariel Fogel, spent a number of months reproducing the bypass and publishing it at this time in a sequence they name “Week of Sandbox Escapes,” one article per day.

These sandboxes draw easy traces. Which means that the agent is trusted inside the challenge workspace and exterior hosts are protected.

The issue is that recordsdata within the workspace should not inert. Instruments operating exterior the sandbox learn and function on them, so the recordsdata that the agent is allowed to jot down can later flip into instructions that the host executes.

What developers expect and what Pillar discovered: The agent remains sandboxed, but the files it writes are trusted by an out-of-box tool (Pillar Security). — **The agent stays sandboxed, however the recordsdata it writes are trusted by instruments exterior the field.**
(pillar safety)

IDE and CLI brokers at all times run their very own instruments exterior of the sandbox. Meaning Python extensions to resolve interpreters, Git integration to scan repositories, VS Code to run activity recordsdata, hook engines to run instructions, Docker Desktop to show native sockets, and extra.

The sandbox agent can observe all the foundations given to it and form the recordsdata that the element reads.

Quick injection is the set off. Malicious directions embedded in READMEs, points, dependencies, or diffs lead to native actions on the developer’s machine.

Pillar categorizes the seven findings into 4 failure modes.

Denylist sandboxes that aren’t suitable with the working system
Workspace configuration that’s truly executable code
a “secure” command authorization listing that trusts names relatively than command arguments, and
A privileged native daemon that’s fully exterior the sandbox.

Bugs and fixes

Most points have been patched and distributors are conscious of them.

Cursor replaces workspace-controlled .claude hook configurations with non-sandboxed command execution. That is at the moment tracked as CVE-2026-48124 and stuck in model 3.0.0.

A second Cursor bug allowed the agent to edit the virtualenv interpreter, inflicting the editor’s Python extension to run by itself throughout discovery.

Third, it exploited the truth that Git metadata doesn’t must reside in a folder referred to as .git to provoke execution by fsmonitor, bypassing Cursor’s path-based guidelines. Patched in 3.0.0, CVE pending.

Within the Codex CLI, the “safe” command allowed-listed the trusted git present by identify, however the precise name was not read-only. OpenAI has patched it in v0.95.0 and issued a excessive severity bounty pending CVE.

One Docker socket detection hit Codex, Cursor, and Gemini CLI on the identical time. A privileged native daemon that the agent has entry to is now a non-sandboxed place to run code. This situation has now been fastened.

Google downgrades two of its corporations

Google’s response to 2 of Antigravity’s findings, bypassing the macOS seatbelt deny listing and bypassing the safe mode .vscode activity settings, was even cooler.

Pillar mentioned Google categorized each as “different legitimate safety vulnerabilities” and downgraded them, figuring out that they’d be troublesome to take advantage of as a result of customers belief repositories that require social engineering or contain oblique immediate injection.

However Piller mentioned Google’s staff nonetheless values its work, citing suggestions that one report was “very prime quality.”

Older points, broader points

The underlying courses should not new. In April, Cymulate documented the identical sample throughout Claude Code, Gemini CLI, and Codex CLI, calling it “Configuration-Primarily based Sandbox Escape.” On this sample, recordsdata written inside the sandbox are executed on the host on the following boot.

What’s new is the breadth. The identical failure happens with 4 instruments from 3 distributors. This can be a extra useful sign for these weighing agent coding instruments.

Pillar’s repair is not one other listing of prohibited file names. A trusted native software watches the second the agent executes what it has written.