Sandbox Escape Vulnerabilities Discovered Across Cursor, OpenAI Codex, Google Gemini CLI, and Antigravity

Summary

Security researchers at Pillar Security discovered seven sandbox escape vulnerabilities across four major AI coding agents, collectively termed the "Week of Sandbox Escapes." The vulnerabilities were identified in Cursor, OpenAI's Codex CLI, Google's Gemini CLI, and Antigravity, revealing a fundamental architectural flaw: while the agents themselves operate within sandboxes, external tools running on the developer's machine outside the sandbox read and execute files the agent is allowed to write, creating escape vectors through prompt injection.

The research team—Eilon Cohen, Dan Lisichkin, and Ariel Fogel—identified four failure modes: denylist sandboxes that cannot keep pace with the operating system, workspace configs that function as executable code, overly permissive "safe" command allowlists that trust command names rather than their arguments, and privileged local daemons outside the sandbox entirely. Examples include Cursor's .claude hook config enabling unsandboxed command execution (CVE-2026-48124, patched in v3.0.0), Codex CLI's Git command allowlist vulnerability (patched in v0.95.0), and a Docker socket issue affecting all three major tools.

Most vendors have released patches and security researchers are working with them on CVE assignments. Google acknowledged two Antigravity findings but downgraded their severity, citing exploitation complexity. The broader concern highlighted by this research is that traditional sandbox approaches—which focus on restricting what agents can do inside—are insufficient when trusted external tools outside the sandbox blindly act on agent-written files.

• Research reveals need for security model shift from simple file/command denylist sandboxes to monitoring what trusted tools actually execute based on untrusted agent-generated data

Editorial Opinion

This research exposes a fundamental architectural flaw in how current AI coding sandboxes operate—they focus on restricting agent actions while trusting external tools that process files the agent is allowed to write. Pillar Security's findings demonstrate that sandbox compliance means nothing if the files produced escape and are executed by trusted tools outside the sandbox perimeter. This critical insight reframes the sandbox debate: the real question isn't whether agents have restricted file system access, but rather whether the broader toolchain treats agent-written files as potentially untrusted data. Until coding assistant vendors address this architectural gap, sandboxes remain theater.