Sandbox escapes hit Cursor, Codex, Gemini CLI

Security researchers found sandbox escape paths in four widely used coding agents: Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. The trick did not require breaking the sandbox directly. Instead, the agent stayed inside its limits and wrote files that trusted tools on the host later executed, loaded, or scanned.

Pillar Security researchers Eilon Cohen, Dan Lisichkin, and Ariel Fogel said they reproduced the bypasses over several months and published the findings as “Week of Sandbox Escapes,” releasing one write-up per day.

These tools typically assume a clean boundary: the agent can operate inside the project workspace, while the host system remains protected. Pillar argues that assumption breaks down because files in the workspace are not passive. External tools routinely act on them, turning an allowed file write into host-side code execution.

×

Pillar says IDEs and CLI agents constantly rely on components running outside the sandbox, including:

Recommended reading

Free 0Patch fix arrives for Windows LegacyHive zero-day

• Python extensions resolving interpreters
• Git integrations scanning repositories
• VS Code task files
• Hook engines firing commands
• Docker Desktop exposing a local socket

That makes prompt injection the trigger. A malicious instruction hidden in a README, issue, dependency, or diff can become a local action on a developer’s machine.

Pillar groups the seven findings into four failure modes:

• denylist sandboxes that cannot keep pace with the operating system
• workspace config that is effectively executable code
• “safe” command allowlists that trust a command’s name instead of its arguments
• privileged local daemons sitting outside the sandbox entirely

Patched issues in Cursor, Codex, and Gemini CLI

Most of the flaws have been patched and acknowledged by vendors. In Cursor, a workspace-controlled .claude hook config led to unsandboxed command execution. It is tracked as CVE-2026-48124 and was fixed in version 3.0.0.

A second Cursor issue let the agent modify a virtualenv interpreter that the editor’s Python extension later executed during discovery. A third used the fact that Git metadata does not have to live in a folder named .git, triggering execution through fsmonitor and bypassing Cursor’s path-based protections. That issue was also patched in 3.0.0, with a CVE pending.

In Codex CLI, a “safe” command allowlist trusted git show by name even though the actual invocation was not read-only. OpenAI patched it in v0.95.0, paid a high-severity bounty, and has a CVE pending. One Docker socket issue affected Codex, Cursor, and Gemini CLI at the same time by exposing a privileged local daemon agents could reach. That finding is now fixed.

Google’s response to Antigravity findings

Pillar said Google took a cooler view of its two Antigravity findings: a macOS Seatbelt denylist bypass and a .vscode task-config bypass of Secure Mode. According to Pillar, Google classified both as “Other valid security vulnerabilities” and downgraded them, arguing they were harder to exploit because they required social engineering or a user trusting a repository carrying an indirect prompt injection.

Pillar said Google’s team still praised the work, including feedback that one report was “of exceptional quality.”

The broader pattern is not new. In April, Cymulate described a similar technique, calling it “Configuration-Based Sandbox Escape,” across Claude Code, Gemini CLI, and Codex CLI, where a file written inside the sandbox executes on the host at the next launch. What stands out here is the spread: the same weakness appeared across four tools from three vendors.

Pillar’s proposed fix is not another denylist of dangerous filenames. It focuses instead on the moment a trusted local tool runs something the agent wrote.

×