Sandbox Circumvented in Cursor, Codex, Gemini CLI and Antigravity: Three Companies, One Trick

The agent remains confined in its sandbox and follows every rule set for it; it simply writes a file that a trusted tool, outside of the sandbox, will execute shortly after: the escape occurs by itself. This is the common thread of the seven vulnerabilities that Pillar Security found and reproduced over several months of work on four of the most widely used AI-based programming assistants: Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity.

The findings, authored by researchers Eilon Cohen, Dan Lisichkin, and Ariel Fogel, were published as a series titled Week of Sandbox Escapes, with one deep dive each day. In almost every case, the agent did not have to directly break out of the sandbox: it was enough to write something that a trusted component outside would then execute, load, or treat as safe.

In April, the company Cymulate documented the same pattern, calling it Configuration-Based Sandbox Escape, on Claude Code, Gemini CLI, and Codex CLI: a file written inside the sandbox that is executed on the host at the next launch. The novelty that emerges from the work of the researchers at Pillar Security is the scale of the problem, with the same flaw now appearing across four tools from three different companies.

The Imaginary Boundary

The sandboxes of these tools draw a simple line: inside the project's workspace, the agent is reliable; outside, the host is protected. The weak point is that files within the workspace are not inert. Python extensions that identify the interpreter, Git integrations that scan repositories, the task runner of VS Code that loads project task files, hook engines that launch commands, the local socket of Docker Desktop: these are all components that run outside the sandbox and read those files. A confined agent can obey every rule yet still shape the inputs that those components consume.

The trigger is once again prompt injection. A malicious instruction hidden in a README, in an issue, in a dependency, or in a diff becomes a local action on the developer's machine. Pillar groups the seven findings into four recurring failure modes: denylist sandboxes that cannot keep up with the complexity of the operating system; workspace configurations that are effectively executable code; allowlist of "safe" commands that trust the name rather than the actual arguments; and privileged local daemons that exist entirely outside the sandbox.

The Flaws and Fixes

Most of the issues have already been fixed and acknowledged by the vendors. In Cursor, a workspace-controllable hook configuration .claude led to unconfined command execution: it is now tracked as CVE-2026-48124 and resolved in version 3.0.0. A second flaw in Cursor allowed the agent to modify the interpreter of a virtual environment that the Python extension of the editor then executed on its own during detection. A third took advantage of the fact that Git metadata doesn't have to reside in a folder called .git, triggering execution via fsmonitor and bypassing path-based rules.

In Codex CLI, an allowlist of "safe" commands trusted git show for the name, while the actual invocation was not read-only: OpenAI fixed the flaw in v0.95.0 and paid a reward for a high-severity bug. A single discovery related to the Docker socket impacted Codex, Cursor, and Gemini CLI together: a privileged local daemon accessible by agents became an unconstrained environment for executing code.

Google's response to the two discoveries on Antigravity was more lukewarm, a bypass of macOS's Seatbelt denylist and a circumvention of Secure Mode via a task configuration file in .vscode. The company categorized both as valid but minor security vulnerabilities, applying a downgrade on the assumption that they are difficult to exploit, as they require social engineering or trust in a repository that conveys indirect prompt injection. Nevertheless, Google's team deemed the work to be of high level, calling one of the reports "of exceptional quality."

For those who must choose one of these tools, it is wise to pay attention to what happens to the files left behind: which components of the host trust what it writes, which local daemons can be reached, which commands bypass approval. The reach of an agent does not cease in its process, and encompasses everything it can write that the host will then treat as reliable.