Skip to content
NewsIncident

Pillar researchers expose sandbox-escape routes across Cursor, Codex CLI, Gemini CLI, and Antigravity

· by Pondero Newsdesk

The short version

Pillar Security published seven coordinated disclosures in July 2026 showing that four major AI coding tools can be escaped without breaking the sandbox boundary directly. Cursor and Codex CLI patched; Google declined to fix both Antigravity findings.

Pillar researchers expose sandbox-escape routes across Cursor, Codex CLI, Gemini CLI, and Antigravity

Four of the most widely used AI coding tools had sandbox designs that could be bypassed without ever crossing the sandbox boundary directly. Pillar Security researchers Eilon Cohen, Dan Lisichkin, and Ariel Fogel released the findings on July 20, 2026 per the Pillar Security blog, publishing one detailed write-up per day in a series called "The Week of Sandbox Escapes." Seven findings covered the four tools by the series end.

What happened

The core pattern was consistent across all seven findings: the sandboxed agent never needed to break out directly. It wrote files that a trusted component outside the sandbox later ran, loaded, or treated as safe configuration. Standard sandbox controls focus on what the agent process can execute, not on what host-side extensions, daemons, or config loaders pick up from agent-created files.

Cursor received three findings. The highest-severity one, CVE-2026-48124, involved a workspace-controlled .claude hook configuration file that routed execution outside the sandbox per advisory GHSA-pc9j-3qc2-95wv. A second flaw let the agent modify a virtualenv interpreter that Cursor's own Python extension then ran during a discovery pass GHSA-p9g2-cr55-cw9c. A third finding exploited Git metadata indirection to bypass path-based sandbox rules by placing metadata in a directory not named .git. Cursor patched all three in version 3.0.0.

OpenAI's Codex CLI had a safe-command allowlist that trusted git command names without modeling their arguments or Git side effects, enabling unauthorized operations outside the expected scope. OpenAI patched the issue in v0.95.0 and paid a high-severity bug bounty per Pillar.

A Docker socket finding ran across three products at once: Cursor, Codex CLI, and Gemini CLI. A privileged local daemon running outside all three sandboxes became a reachable unsandboxed execution environment. That issue is fixed GHSA-v4xv-rqh3-w9mc.

Google's Antigravity produced two findings. In the first, a permissive sandbox profile left OS features reachable that allowed execution beyond the expected boundary. In the second, the agent wrote a VSCode task configuration that the host later ran on its own schedule. Google acknowledged both findings and called one report "of exceptional quality," then classified both as "Other valid security vulnerabilities," applied a difficulty-of-exploit downgrade, and issued no patches.

Why it matters

Cursor and Codex CLI users on versions below the patched releases should update immediately. Cursor 3.0.0 closed all three tracked findings. Codex CLI v0.95.0 closed the allowlist issue.

For Antigravity users, no patch is available. The Pillar team described the attack preconditions: a malicious repository or an indirect prompt-injection path through untrusted project content.

The deeper concern is structural. Pillar identified four repeating failure modes across the series: denylist sandboxes that cannot track OS complexity, workspace configuration files treated as executable code, allowlists that trust command names rather than full invocations, and privileged local daemons that sit entirely outside the sandbox perimeter. None of these are single-vendor design choices. Any agentic coding tool that writes files into a project can hit the same pattern if host-side components trust those files without re-checking authorization.

Pillar's framing captures the practical exposure: the agent's blast radius is not its process alone. It includes everything that a host component later trusts from files the agent wrote. Developer machines running these tools often carry cloud credentials, SSH keys, and package-registry permissions in the same session.

What to watch next

Google has not committed to patching the Antigravity findings following public disclosure. Other widely used coding agents, including Claude Code, Windsurf, and Aider, were not covered in this series. If the same file-write methodology is applied to those tools, similar structural findings are possible. Security teams governing developer endpoints should log and review file writes from AI coding agents the same way they monitor other endpoint actors.

Sources