Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
TL;DR
- Pillar identified four repeatable escape vectors across all four agents, proving the failure is architectural: agents write files that unsandboxed downstream tools later execute.
- Antigravity's Secure Mode is bypassed entirely because the 'find_by_name' native tool executes before protection mechanisms evaluate the call, per CyberScoop.
- CSA extends the affected surface beyond the four named products, linking parallel vulnerabilities in GitHub Copilot Agent and Claude Code to the same root cause.
The neat trick Pillar Security's Eilon Cohen, Dan Lisichkin, and Ariel Fogel pulled off across four AI coding agents is that they never really attacked the sandboxes at all. As BleepingComputer reported, the agent "stays inside the box and follows every rule. It just writes a file that a trusted tool outside the box later runs, loads, or scans, and the escape happens on its own."
The affected tools are the ones every AI-first developer already has open: Cursor, OpenAI's Codex, Google's Gemini CLI, and Google's Antigravity. In Cursor, a workspace-controlled .claude hook config could turn into unsandboxed command execution, tagged CVE-2026-48124 and patched in version 3.0.0. In Codex CLI, an allowlist trusted "git show" by name even though the actual invocation was not read-only; OpenAI shipped a fix in v0.95.0 and awarded a high-severity bounty. One Docker socket finding hit Codex, Cursor and Gemini CLI at once, because a privileged local daemon the agents could reach was itself outside the sandbox.
Why this matters is that the sandbox threat model most of these tools ship with draws a single line: the agent is trusted inside the workspace, the host outside is protected. But files inside the workspace are not inert. VS Code extensions read them, Python interpreters get invoked from them, Docker sockets act on them, Git tools parse metadata from them. Any trusted tool that later touches an agent-written file becomes a route out.
The honest caveat is that most of these are patched, and Google downgraded the two Antigravity findings, a macOS Seatbelt denylist bypass and a .vscode task-config bypass, as "Other valid security vulnerabilities," judging them harder to exploit because of social-engineering requirements. What the reporting doesn't give you is real-world exploitation data, upgrade rates, or how many similar patterns are still lurking in less-scrutinized agents.
The thing to watch is whether vendors rebuild around allowlisted output paths and constrained writes, rather than trying to enumerate every unsafe operation. Agents that write files any downstream tool will happily execute are a much bigger perimeter than the sandbox alone.
What others are reporting
-
Pillar Security Read →
First-party research post documenting all four escape vectors and establishing the trust-handoff threat model that unifies them across products.
If an agent gets to write the future inputs of systems, it was never sandboxed in the first place.
-
CyberScoop Read →
Focuses on Antigravity's native tool bypass with a researcher quote; argues sanitization-based controls are structurally insufficient for agentic AI systems.
The security boundary that Secure Mode enforces simply never sees this call.
-
Cloud Security Alliance Read →
Maps the findings to MAESTRO and the AI Controls Matrix, extends the scope to GitHub Copilot Agent and Claude Code, and calls this a systemic architectural gap not addressable by patches alone.
Native tool privilege bypass and startup configuration abuse are not specific to Antigravity and likely to recur across agentic developer tools.
Originally reported by bleepingcomputer.com
Read the original article →Original headline: Pillar Security Finds Sandbox Escapes in Cursor, Codex, Gemini CLI, and Antigravity Coding Agents