Skip to content
NewsIncident

Pillar Security discloses sandbox escapes in four AI coding agents: Cursor, OpenAI Codex, Gemini CLI, and Antigravity all patched

· by Pondero Newsdesk

The short version

Pillar Security researchers published seven coordinated disclosures across Cursor, OpenAI Codex CLI, Google Gemini CLI, and Google Antigravity on July 20, 2026, showing how agents write files that trusted host tools execute outside the sandbox.

Pillar Security discloses sandbox escapes in four AI coding agents: Cursor, OpenAI Codex, Gemini CLI, and Antigravity all patched

A security research team at Pillar Security found a way to escape the sandbox on four widely used AI coding agents without attacking the sandbox boundary itself. The method: write a file inside the trusted workspace, then let the host environment pick it up and execute it outside the container. Pillar researchers Eilon Cohen, Dan Lisichkin, and Ariel Fogel published the series, titled "Week of Sandbox Escapes," on July 20, 2026, disclosing seven vulnerabilities across Cursor, OpenAI Codex CLI, Google Gemini CLI, and Google Antigravity. All four tools received patches or vendor responses before publication.

What

The research identified four structural failure modes. Sandbox denylists grow complex enough that OS features slip through allowlist gaps. Workspace configuration files that agents can modify become execution vectors when the host reads them later. Policies that trust command names without verifying actual invocations and side effects create bypass paths. Unsandboxed local daemons, such as Docker Desktop, sit inside the network the agent can reach per Pillar's full disclosure.

Cursor drew three separate disclosures, all patched in v3.0.0. CVE-2026-48124 (GHSA-pc9j-3qc2-95wv) covered a .claude hook configuration that an agent could modify to trigger unsandboxed command execution. A second flaw (GHSA-p9g2-cr55-cw9c) let the agent overwrite the virtualenv interpreter that Cursor's Python extension ran during environment discovery. A third used Git metadata indirection to bypass path-based sandbox rules; its CVE is still pending.

OpenAI Codex CLI's "safe command" allowlist trusted the name git show by name without checking the invocation's actual side effects. That allowlist bypass, combined with a shared Docker socket vulnerability (GHSA-v4xv-rqh3-w9mc) that affected Codex CLI, Cursor, and Gemini CLI simultaneously, gave an agent access to the Docker Desktop daemon running entirely outside any sandbox per BleepingComputer. OpenAI patched both issues in Codex CLI v0.95.0 and paid a high-severity bug bounty; the CVE for the allowlist flaw is still pending.

Google Antigravity had two issues: a macOS Seatbelt denylist bypass and a VS Code task-configuration bypass of Antigravity's Secure Mode. Google classified both as valid security vulnerabilities but downgraded their severity, citing exploitation difficulty because the attack chains require social engineering.

Why it matters

Per Pillar Security: "an agent's blast radius is not the agent process; it includes everything the agent can write that the host later trusts." That framing redefines what sandboxing actually delivers in agentic coding tools. A developer who opens a malicious repository in Cursor, Codex CLI, or Gemini CLI could trigger unsandboxed code execution without any explicit prompt, because the agent reaches configuration files and interpreters that sit outside the sandbox boundary by design.

The scope of the risk runs wider than these four tools. AI coding agents routinely write to shared filesystems and modify virtual environments. Any of those touch points can be a trust boundary the host stack never hardened. The Docker-socket exposure alone, shared across three separate products (GHSA-v4xv-rqh3-w9mc), shows that this is not a per-tool defect but a property of how agentic tools are typically integrated with local development environments.

The patch path for developers is concrete. All three Cursor vulnerabilities are addressed in Cursor v3.0.0. Teams running Cursor on earlier versions should update before cloning untrusted repositories. Codex CLI users should move to v0.95.0. Both updates were available before Pillar published, so the exposure window for patched installations closed at disclosure.

Context and reactions

Pillar followed a 90-day coordinated disclosure process with each affected vendor before publication. OpenAI's decision to pay a high-severity bounty signals the company treated the Codex allowlist bypass as a genuine security defect rather than a deliberate design tradeoff. Google's severity downgrade for Antigravity drew a technical distinction between reachability and realistic exploitability, though Google did not contest Pillar's analysis of how the bypasses work.

Pillar built the research on its SAIL framework, which maps threat models specific to multi-step AI agents. The four failure modes the team documented correspond directly to SAIL's taxonomy of trust-boundary violations in agentic pipelines, and the series marks the largest coordinated AI-coding-tool disclosure sequence published in 2026.

What to watch next

Pillar is releasing one new write-up per day through July 25, 2026. Additional CVEs covering tools not named in the July 20 batch may follow before the series ends. The Docker-socket vector (GHSA-v4xv-rqh3-w9mc) is systemic: any agentic coding tool that exposes a shared container runtime carries a version of the same risk, regardless of how its own process-level sandbox is implemented. VS Code extension ecosystem configurations and JetBrains AI Assistant setups represent the most likely adjacent surfaces, based on the failure modes Pillar already documented.

Sources