Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes

1. Executive summary

Pillar Security researchers demonstrated sandbox escapes across four widely used AI coding agents — Cursor, OpenAI Codex CLI, Google Gemini CLI, and Google Antigravity — by having the agent write files that trusted host-side tools subsequently execute, load, or scan. The attack class, "Configuration-Based Sandbox Escape," bypasses sandbox boundaries without attacking the sandbox directly; instead, prompt injection triggers the agent to write malicious config or metadata files that out-of-sandbox components (Python extensions, Git integrations, VS Code task runners, hook engines, Docker Desktop) act upon. Most issues are patched and vendor-acknowledged (Cursor 3.0.0, Codex CLI v0.95.0); Google downgraded two Antigravity findings to "Other valid security vulnerabilities," judging them difficult to exploit without social engineering. EMEA financial services firms deploying agentic coding tools in SDLC pipelines face risk of developer workstation compromise and potential source-code or credential exfiltration via this vector.

2. Regulatory framing

3. Technical analysis & attack chain

Verified reference data: No CVE records, CVSS scores, or CISA-KEV entries were resolved for this item. The CVE identifiers below (CVE-2026-48124 and pending CVEs) are sourced solely from the BleepingComputer report and are not independently verified in the provided reference data. Treat all CVE numbers, severity ratings, and exploitation states as single-sourced and unconfirmed until corroborated by NVD or vendor advisories.

Attribution: Pillar Security researchers Eilon Cohen, Dan Lisichkin, and Ariel Fogel are credited with the findings. No MITRE ATT&CK actor profile is available in the verified reference data; this is researcher disclosure, not threat-actor attribution.

Attack chain (confirmed from source)

1. Prompt injection payload delivery. A malicious instruction is planted in a project artifact the agent reads — a README, an issue ticket, a dependency, or a diff. This constitutes an indirect prompt injection.
2. Agent writes file inside workspace. The sandboxed agent obeys all sandbox rules but writes a file within the trusted project workspace. The file is not inert: it is a config file, hook definition, interpreter path, or Git metadata structure that a host-side tool will later read and act on.
3. Trusted host tool executes/loads the file. A tool running outside the sandbox — a Python extension resolving interpreters, a Git integration scanning repos, VS Code running task files, a hook engine firing commands, or Docker Desktop exposing a local socket — reads the agent-written file and executes code, loads a payload, or performs an action on the host.
4. Sandbox escape achieved. Execution occurs on the developer's machine outside the sandbox boundary, without the agent directly attacking the sandbox itself.

Four failure modes (Pillar Security taxonomy)

• Denylist sandboxes that cannot keep pace with the OS. Path-based or filename-based denylists miss new or renamed OS-level components and metadata locations.
• Workspace config that is really executable code. Configuration files written inside the workspace (e.g., .claude hook configs, .vscode task files) are treated as inert data but are executed by host tooling.
• "Safe" command allowlists that trust a command name, not its arguments. A command like git show is allowlisted by name, but the actual invocation is not read-only, enabling argument-based abuse.
• Privileged local daemons outside the sandbox. Daemons such as Docker Desktop's local socket sit outside the sandbox entirely; if the agent can reach the socket, it can run code in an unsandboxed context.

Specific findings

Cursor — .claude hook config escape (CVE-2026-48124). A workspace-controlled .claude hook configuration file turned into unsandboxed command execution when the host hook engine fired. Fixed in Cursor version 3.0.0. CVE-2026-48124 is single-sourced from the BleepingComputer report; no NVD or CISA-KEV record is available in the verified reference data.

Cursor — virtualenv interpreter escape. The agent edited a virtualenv interpreter path that Cursor's Python extension then executed on its own during interpreter discovery. No CVE or fix version stated in the source for this specific sub-issue.

Cursor — Git metadata fsmonitor escape. The agent wrote Git metadata to a folder not named .git, bypassing Cursor's path-based sandbox rules. Execution fired through Git's fsmonitor mechanism. Patched in Cursor 3.0.0; CVE pending.

Codex CLI — git show allowlist escape. The "safe" command allowlist trusted git show by name, but the actual invocation was not read-only, allowing argument-based abuse. OpenAI patched in Codex CLI v0.95.0 and paid a high-severity bounty. CVE pending.

Docker socket finding (Codex, Cursor, Gemini CLI). A privileged local daemon (Docker Desktop local socket) reachable by all three agents became an unsandboxed execution path. Now fixed across all three tools. No CVE identifiers stated in the source.

Antigravity — macOS Seatbelt denylist bypass. A denylist-based sandbox bypass on macOS. Google classified this as "Other valid security vulnerability" and applied a downgrade, citing difficulty of exploitation without social engineering or user trust of a repository carrying indirect prompt injection. Not patched at time of publication per source.

Antigravity — .vscode task-config Secure Mode bypass. A .vscode task configuration file bypassed Antigravity's Secure Mode. Google applied the same downgrade classification. Not patched at time of publication per source.

Prior art. Cymulate documented the same pattern in April 2026, naming it "Configuration-Based Sandbox Escape," across Claude Code, Gemini CLI, and Codex CLI. This corroborates the vulnerability class but is a separate research disclosure.

4. Mitigation & containment

P1 — Within 24 hours

• Inventory AI coding-agent deployments. Identify all developer workstations and CI/CD runners running Cursor, Codex CLI, Gemini CLI, or Antigravity. Determine versions in use.
• Patch Cursor to 3.0.0. This fixes CVE-2026-48124 (.claude hook config escape) and the Git metadata fsmonitor escape. Verify the virtualenv interpreter escape status with the vendor — no fix version is stated in the source for that sub-issue.
• Patch Codex CLI to v0.95.0. This fixes the git show allowlist escape.
• Restrict Docker socket access. Ensure the Docker Desktop local socket is not reachable by sandboxed agents. Remove the user running the agent from the docker group or apply socket-level ACLs. The Docker socket finding is confirmed fixed across Codex, Cursor, and Gemini CLI, but verify the specific patched versions with each vendor.

P2 — Within 72 hours

• Disable or restrict Antigravity Secure Mode reliance. Google has not patched the two Antigravity findings (macOS Seatbelt denylist bypass, .vscode task-config bypass) at time of publication. Do not rely on Secure Mode or Seatbelt denylisting as a sole sandbox control for Antigravity. Consider suspending Antigravity use for projects that process untrusted code, issues, or dependencies.
• Audit workspace config files. Identify and review .claude hook configs, .vscode task files, and any other workspace-level configuration that host-side tooling executes. Treat these as executable code, not inert data.
• Review command allowlists. If using Codex CLI or similar tools with command allowlists, verify that allowlisted commands are constrained by argument, not just by command name. git show and similar commands with mutable arguments should be argument-scoped or removed from allowlists.
• Restrict Git metadata paths. Ensure sandbox path rules cover Git metadata regardless of folder name (not just .git). Cursor 3.0.0 addresses this for Cursor; verify equivalent coverage in other tools.

P3 — Within 7 days

• Implement host-side file-write monitoring. Pillar's recommended fix is not filename denylisting but monitoring the moment a trusted local tool runs something the agent wrote. Deploy EDR or file-integrity monitoring rules that alert when host-side tools (Python extensions, Git integrations, VS Code task runners, hook engines) execute or load files recently written within agent workspace directories.
• Evaluate prompt-injection hardening. Review agent prompt-handling for indirect prompt-injection resistance. The attack chain requires prompt injection as the trigger; reducing the agent's propensity to act on injected instructions in README files, issues, dependencies, or diffs reduces the attack surface.
• Incorporate sandbox-escape testing into resilience testing. Under DORA Art. 24, add AI coding-agent sandbox-escape scenarios to the testing programme, including prompt-injection-driven file-write-to-host-execution chains.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

rule AT_AI_Agent_Sandbox_Escape_Config_Files {
  meta:
    author = "Adverse Trace"
    date = "2026-07-21"
    reference = "https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/"
    description = "Detects agent-written config files used in sandbox escapes across Cursor, Codex CLI, Gemini CLI, Antigravity"
  strings:
    $claude_hook = ".claude" ascii
    $vscode_task = ".vscode/tasks" ascii
    $fsmonitor_ref = "fsmonitor" ascii
    $git_show = "git show" ascii
  condition:
    2 of them
}

title: AI Agent Sandbox Escape via Host-Side Tool Execution of Agent-Written File
id: 7a3c1f2e-2026-0721-at357
status: experimental
description: >
  Detects the core sandbox-escape pattern: a file written by an AI coding agent
  process is subsequently executed or loaded by a trusted host-side tool
  (Python extension, Git integration, VS Code task runner, hook engine).
  Based on Pillar Security "Week of Sandbox Escapes" findings.
author: Adverse Trace
date: 2026/07/21
references:

  - https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/
logsource:
  product: windows
  category: process_creation
detection:
  agent_process:
    Image|endswith:

      - '\cursor.exe'
      - '\codex.exe'
      - '\gemini.exe'
      - '\node.exe'
  host_tool_execution:
    Image|endswith:

      - '\python.exe'
      - '\git.exe'
      - '\code.exe'
      - '\docker.exe'
  filter_legitimate:
    ParentImage|endswith:

      - '\explorer.exe'
      - '\cmd.exe'
      - '\powershell.exe'
  condition: host_tool_execution and not filter_legitimate
falsepositives:

  - Legitimate developer workflow where host tools run after agent file writes
  - Normal IDE extension activity unrelated to agent-written files
level: medium

7. Sources

• BleepingComputer, "Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes," https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/, 2026-07-20

8. Adverse Trace position

This is a significant vulnerability class disclosure, not a single-CVE advisory. The attack pattern — agent writes a file, host tool executes it — is architecturally simple, reproducible across four tools from three vendors, and requires only indirect prompt injection as the trigger, which is trivially deliverable via a malicious README, issue, or dependency. The severity for EMEA financial services depends on deployment context: firms using these agents in production SDLC pipelines with access to source code, credentials, or build systems face the highest risk. Patching Cursor to 3.0.0 and Codex CLI to v0.95.0 is the immediate priority. Antigravity's two unpatched findings (downgraded by Google) warrant suspension of the tool for untrusted-input projects. The Docker socket finding, now fixed across three tools, underscores that privileged local daemons are a systemic blind spot in agent sandboxing. We assess this as a high-severity architectural weakness class with active research interest; expect additional findings as the pattern is applied to other agentic tools. We will monitor for CVE publication, CISA-KEV listing, and any follow-on exploitation reporting. All CVE identifiers in this advisory are single-sourced from the BleepingComputer report and unconfirmed by NVD — verify before enforcement.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.