Pillar Security demonstrates sandbox escapes in four AI coding agents
Summary
Pillar Security demonstrated sandbox escapes in Cursor, Codex CLI, Gemini CLI and Antigravity using workspace files that trusted host tools later executed or scanned. Several flaws were patched; Google downgraded two Antigravity findings.
Key points
- Pillar Security says prompt injections in workspace content can lead an agent to write files that trusted tools outside the sandbox later execute, load, or scan.
- The researchers grouped seven findings into four failure modes: denylist gaps, executable workspace configuration, command allowlists that trust command names, and privileged local daemons.
- A workspace-controlled Cursor hook configuration enabled unsandboxed command execution; the issue is tracked as CVE-2026-48124 and was fixed in version 3.0.0.
- Other Cursor findings involved an editor Python extension running an agent-modified virtualenv interpreter and Git metadata tricks that bypassed path-based rules; the Git issue was patched in version 3.0.0, with a CVE pending.
- A Codex CLI allowlist flaw treated git show as safe based on its name; OpenAI patched it in version 0.95.0. A Docker socket issue affecting Codex, Cursor, and Gemini CLI was also fixed.
- According to Pillar Security, Google downgraded two Antigravity findings involving a macOS Seatbelt denylist bypass and a Secure Mode task-configuration bypass, citing social engineering or user trust of a repository as barriers to exploitation.
- Pillar recommends monitoring when trusted local tools run files written by an agent, rather than relying only on banned filenames.
Article Details
- Attack Vectors
- Prompt injection in workspace content such as a README, issue, dependency, or diff could cause an AI coding agent to write files that trusted tools outside the sandbox later execute or scan.
- A workspace-controlled Cursor hook configuration enabled unsandboxed command execution.
- An agent could modify a virtualenv interpreter that the editor's Python extension later executed during discovery.
- Git metadata outside a folder named .git could trigger execution through fsmonitor and bypass Cursor's path-based rules.
- Codex CLI's command allowlist trusted git show by name even when the invocation was not read-only.
- A reachable Docker socket exposed a privileged local daemon that could run code outside the agents' sandboxes.
- Antigravity's macOS Seatbelt denylist and Secure Mode were bypassed through a task-configuration file; Google reportedly judged the findings difficult to exploit because they required social engineering or trust in a repository carrying an indirect prompt injection.
- Defensive Notes
- Pillar Security recommended monitoring when a trusted local tool runs content written by an agent, rather than relying only on banned filenames.
- Cursor fixed the hook issue and the Git metadata issue in version 3.0.0.
- OpenAI patched the Codex CLI command-allowlist issue in version 0.95.0.
- The article reports that the Docker socket issue was fixed; it does not specify a version.
- Google downgraded both Antigravity findings, while Pillar reported that Google still rated one report as being of exceptional quality.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe findings included unsandboxed command execution through a Cursor hook, Git fsmonitor, a Codex CLI command-allowlist bypass, and Docker socket access.T1059.006 · PythonIn one Cursor finding, the agent modified a virtualenv interpreter that the editor's Python extension subsequently ran during discovery.T1546 · Event Triggered ExecutionWorkspace-controlled hook and task configuration, as well as Git fsmonitor, could trigger execution when trusted tools processed the agent-written files.T1611 · Escape to HostThe reported sandbox escapes let agent-written files cause trusted host-side tools or a privileged local daemon to execute code outside the sandbox.
CVE
People
Ariel FogelPillar Security researcher who participated in reproducing the reported sandbox bypasses.Dan LisichkinPillar Security researcher who participated in reproducing the reported sandbox bypasses.Eilon CohenPillar Security researcher who participated in reproducing the reported sandbox bypasses.
Vendors
CursorSecurity researchers from Pillar Security demonstrated sandbox escapes in Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity by planting files that trusted tools outside the sandbox later executed or scanned.GoogleSecurity researchers from Pillar Security demonstrated sandbox escapes in Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity by planting files that trusted tools outside the sandbox later executed or scanned.OpenAISecurity researchers from Pillar Security demonstrated sandbox escapes in Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity by planting files that trusted tools outside the sandbox later executed or scanned.
Products
AntigravitySecurity researchers from Pillar Security demonstrated sandbox escapes in Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity by planting files that trusted tools outside the sandbox later executed or scanned.Codex CLISecurity researchers from Pillar Security demonstrated sandbox escapes in Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity by planting files that trusted tools outside the sandbox later executed or scanned.CursorSecurity researchers from Pillar Security demonstrated sandbox escapes in Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity by planting files that trusted tools outside the sandbox later executed or scanned.Gemini CLISecurity researchers from Pillar Security demonstrated sandbox escapes in Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity by planting files that trusted tools outside the sandbox later executed or scanned.