What happened

Security researchers at Pillar Security spent months breaking out of the safety sandboxes built into four AI coding agents: Cursor, OpenAI’s Codex CLI, Google’s Gemini CLI, and Antigravity, Google’s agentic coding IDE. They published the results on July 20, 2026, as a series called the Week of Sandbox Escapes, one write-up a day.

A sandbox is the walled-off area a coding agent runs in. It can read and edit files inside your project, but it should not be able to touch anything outside that project, like your SSH keys or your Docker settings. Pillar’s team, Eilon Cohen, Dan Lisichkin, and Ariel Fogel, found seven ways an agent could still reach outside that wall, spread across all four tools.

Why it matters

None of the seven bugs attacked the sandbox head-on. In every case, the agent stayed inside its box and followed every rule it was given. It just wrote a file that a different, unsandboxed tool later trusted and ran.

Pillar summarizes the pattern this way: if an agent can write the future input of another system, that system was never really sandboxed. IDEs and CLI agents constantly hand off to tools running outside the sandbox: a Python extension resolving which interpreter to use, a Git integration scanning repository metadata, VS Code running a task file, a hook engine firing a command, Docker Desktop exposing a local socket. A sandboxed agent can still shape any of those inputs.

Here is what Pillar found and where each stands:

  • Cursor: a workspace .claude hook config could trigger unsandboxed command execution. Tracked as CVE-2026-48124, fixed in version 3.0.0.
  • Cursor: the agent could edit a virtualenv interpreter that the editor’s own Python extension then ran automatically during discovery. Fixed, tracked as GHSA-p9g2-cr55-cw9c.
  • Cursor: Git metadata does not have to live in a folder literally named .git, so an agent could trigger execution through fsmonitor and slip past Cursor’s path-based rules. Patched in 3.0.0, with a CVE still pending.
  • Codex CLI: a “safe” command allowlist trusted the name git show without checking that the actual invocation was read-only. OpenAI patched it in v0.95.0 and paid a high-severity bug bounty, with a CVE pending.
  • Cursor, Codex CLI, and Gemini CLI: all three could reach a local Docker socket, a privileged daemon that sits outside the sandbox, and use it to run unsandboxed code. Pillar says this is now fixed, but does not list separate patched versions for each tool.
  • Antigravity: a macOS Seatbelt denylist bypass and a .vscode task-config bypass of its Secure Mode. Google classified both as “Other valid security vulnerabilities,” a lower severity tier, judging them harder to exploit because they need either social engineering or a user trusting a repository that carries an indirect prompt injection. Pillar says Google’s team still called one of the two reports “of exceptional quality.”

This is not the first time this class of bug has surfaced. On July 9, security firm Cymulate documented a similar pattern, which it called Configuration-Based Sandbox Escape, across three different tools: Claude Code, Gemini CLI, and Codex CLI. That was a separate report with its own set of specific bugs, but it points to the same underlying gap between “sandboxed agent” and “unsandboxed local tool” showing up across the category, not just in one product. We covered a related trust-boundary failure, GhostApproval’s symlink bug, on July 9 as well.

Who should care

Anyone who runs a coding agent, IDE plugin, or CLI tool against a repository they did not write themselves should care. Prompt injection is the trigger for most of these bugs: a malicious instruction hidden in a README, an issue, a dependency, or a diff becomes a local action on your machine once a trusted tool outside the sandbox reads the file the agent wrote.

You carry more risk if you routinely open unfamiliar repositories, clone starter templates, or accept README setup instructions without reading them first, and if your machine runs Docker Desktop or another local daemon your agent can reach.

What builders should do next

Check your version against the ones Pillar and the vendors confirmed as patched:

  • Cursor: update to 3.0.0 or later. Check under Cursor’s Help/About panel, or let its built-in updater run.
  • Codex CLI: update to v0.95.0 or later. Run:
codex --version
  • Gemini CLI: Pillar’s report does not list a specific patched version for the Docker socket fix on this tool. Watch Google’s own security advisories rather than assuming a recent update already covers it.

Beyond version checks, treat your Docker socket and any local daemon your agent can reach as part of its trust boundary, not outside it. Keep treating unfamiliar repositories as untrusted input: a workspace config file like .vscode, .claude, or Git metadata can carry instructions that a tool outside the sandbox will later execute, even when the agent itself never leaves its box.

End of article