--- title: Sandbox escape vulnerabilities found in Cursor, Codex,... description: Security researchers at Pillar Security disclosed sandbox escape vulnerabilities in four AI coding agents: Cursor, OpenAI Codex CLI, Google Gemini CLI, and... canonical: https://daily.dev/posts/sandbox-escape-vulnerabilities-found-in-cursor-codex-gemini-cli-and-antigravity-gtjsqcy0e twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Sandbox escape vulnerabilities found in Cursor, Codex, Gemini CLI, and Antigravity | daily.dev og:description: Security researchers at Pillar Security disclosed sandbox escape vulnerabilities in four AI coding agents: Cursor, OpenAI Codex CLI, Google Gemini CLI, and... og:url: https://daily.dev/posts/sandbox-escape-vulnerabilities-found-in-cursor-codex-gemini-cli-and-antigravity-gtjsqcy0e og:image: https://api.daily.dev/og/posts/gTJSqcy0E.png og:image:alt: Sandbox escape vulnerabilities found in Cursor, Codex, Gemini CLI, and Antigravity og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Sandbox escape vulnerabilities found in Cursor, Codex, Gemini CLI, and Antigravity **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary Security researchers at Pillar Security disclosed sandbox escape vulnerabilities in four AI coding agents: Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity. The attack pattern is indirect — agents write files inside their workspace that trusted host-side tools (Python extensions, Git integrations, VS Code task runners, Docker sockets) later pick up and execute, bypassing the sandbox without breaking it directly. Seven findings were grouped into four failure modes: denylist sandboxes that can't track OS changes, workspace config files that are executable code, command allowlists that check names but not arguments, and privileged local daemons running outside the sandbox. Attack vectors include prompt injection via README files, code comments, dependencies, and Git metadata manipulation. Most issues have been patched — Cursor fixed CVE-2026-48124 in v3.0.0, Codex addressed its issues in v0.95.0. Pillar recommends behavioral monitoring (watching when trusted tools execute agent-written files) over denylist approaches. The findings arrive as AI coding agent adoption has grown 357% since early 2025, outpacing security infrastructure. ## Content Security researchers at Pillar Security have disclosed sandbox escape vulnerabilities across four AI coding agents: Cursor, OpenAI's Codex CLI, Google's Gemini CLI, and Antigravity. The core finding is a bit counterintuitive: the agents don't break out of their sandboxes directly. Instead, they write files inside the workspace that trusted host-side tools — Python extensions, Git integrations, VS Code task runners, Docker sockets — later pick up and execute. The sandbox stays intact; the blast radius expands around it. Pillar grouped seven findings into four failure modes: - **Denylist sandboxes** that can't keep pace with OS-level changes - **Workspace config files** that are actually executable code - **Command allowlists** that check names but not arguments - **Privileged local daemons** running outside the sandbox entirely Attack vectors include prompt injection through README files, code comments, and dependencies, as well as Git metadata manipulation and Python virtual environment tampering. An attacker doesn't need to compromise the agent directly — they just need to get malicious content into something the agent reads. Most issues have been patched. Cursor fixed its flaw (CVE-2026-48124) in version 3.0.0; Codex addressed its issues in v0.95.0. Google downgraded its two Antigravity findings, arguing they require social engineering and are therefore harder to exploit in practice. Pillar's proposed longer-term fix shifts the monitoring approach: rather than maintaining lists of banned filenames, defenders should watch for when trusted local tools execute files that an agent wrote — a behavioral signal that's harder to evade. The timing matters. AI coding agent adoption has reportedly grown 357% since early 2025, and the security infrastructure around these tools hasn't kept up. The endpoint threat model is changing — agents that can read, write, and indirectly trigger execution across a development environment are a meaningfully different risk surface than a traditional IDE plugin. As Box CEO Aaron Levie noted when the research surfaced, the defensive answer is probably more AI, not less — automated systems scanning codebases and networks for exactly these kinds of indirect execution paths. Which is either reassuring or its own kind of unsettling, depending on how you look at it. --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/sandbox-escape-vulnerabilities-found-in-cursor-codex-gemini-cli-and-antigravity-gtjsqcy0e) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Sandbox escape vulnerabilities found in Cursor, Codex, Gemini CLI, and Antigravity","url":"https://daily.dev/posts/sandbox-escape-vulnerabilities-found-in-cursor-codex-gemini-cli-and-antigravity-gtjsqcy0e","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sandbox-escape-vulnerabilities-found-in-cursor-codex-gemini-cli-and-antigravity-gtjsqcy0e"},"datePublished":"2026-07-22T14:43:53.490Z","dateModified":"2026-07-22T16:21:07.054Z","description":"Security researchers at Pillar Security disclosed sandbox escape vulnerabilities in four AI coding agents: Cursor, OpenAI Codex CLI, Google Gemini CLI, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/463eaf44078e9300bd49002de4527796?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/463eaf44078e9300bd49002de4527796?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sandbox-escape-vulnerabilities-found-in-cursor-codex-gemini-cli-and-antigravity-gtjsqcy0e","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,prompt-injection","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Sandbox escape vulnerabilities found in Cursor, Codex, Gemini CLI, and Antigravity"}]} ```