// NEXUSVOID CYBER NEWS

<- ALL CYBER NEWS

High

AI agents, Cursor, Codex, Gemini CLI, Antigravity, sandbox escape, CVE-2026-48124, prompt injection

AI Coding Agent Sandbox Escapes Hit Cursor, Codex

AI coding agent sandbox escapes in Cursor, Codex, Gemini CLI and Antigravity let the agent write files trusted host tools then run (CVE-2026-48124). Patch now.

Published July 21, 2026.

Security researchers escaped the sandboxes of Cursor, OpenAI Codex, Google Gemini CLI and Antigravity by having the AI agent write files that trusted host tools later run — the agent stays boxed, but its output does not. The core Cursor flaw is tracked as CVE-2026-48124 and fixed in v3.0.0; update your AI coding tools and treat agent-written files as untrusted.

What happened. Pillar Security's team (Eilon Cohen, Dan Lisichkin and Ariel Fogel) disclosed a series of sandbox escapes across major AI coding tools as part of a "Week of Sandbox Escapes." The shared root cause: the agent stays sandboxed, but the files it writes are trusted by tools outside the box. An attacker plants malicious instructions in content the agent will process — a README, a dependency, a diff — and the agent writes configuration or hook files that an external, unsandboxed tool then executes without re-validation. In effect, the sandbox contains the agent but not its side effects. The core Cursor flaw is catalogued as CVE-2026-48124.

Which AI coding tools are affected?

Tool

Issue

Fix

Cursor

.claude hook config execution (CVE-2026-48124); virtualenv interpreter and Git-metadata bypasses

v3.0.0

OpenAI Codex CLI

Git command allowlist bypass (CVE pending)

v0.95.0

Gemini CLI

Docker-socket privilege-escalation variant of CVE-2026-48124

Vendor update

Antigravity

Two findings Google classified as "other valid" (require social engineering)

Vendor update

How does the sandbox escape work?

The agent is confined, but the artifacts it produces are not. Malicious text injected into a repository (README, dependency manifest, or diff) steers the agent into writing a hook, config, or interpreter file. A trusted host tool — the editor, a Git hook, a Docker socket, or a package interpreter — then runs that file with the developer's own privileges. No exploit of the model itself is needed; the gap is the trust boundary between "sandboxed agent output" and "host tool input."

What to do now.

  • Update Cursor to v3.0.0 and Codex CLI to v0.95.0, and apply the latest Gemini CLI and Antigravity releases.

  • Treat agent-written files as untrusted: review hook, config, and CI files an agent creates before any host tool runs them.

  • Run coding agents with least privilege — no host Docker-socket access, scoped Git allowlists, and no ambient credentials the agent does not need.

  • Assume malicious content in repos: untrusted READMEs, issues, and dependencies are prompt-injection surfaces.

Who's affected. Developers and teams running Cursor, OpenAI Codex CLI, Google Gemini CLI, or Antigravity with agentic (file-writing) features enabled, especially against untrusted repositories.

Our read. This is the AI-agent attack surface we keep pointing at: the model can be perfectly "aligned" and still be the delivery mechanism, because the exploit lives in the trust boundary around it, not in the model. A capability that only shows up when a real adversary feeds the agent hostile input is exactly what supervised adversary simulation is for — you cannot find a trust-boundary escape by asking the agent nicely; you find it by having someone try to break out. Patching the four named tools closes today's holes; treating every agent-written file as untrusted closes the class.

Reporting by BleepingComputer; vulnerability detail and disclosure per Pillar Security. Sources linked above. Related: our supervised adversary simulation approach.

Liked this briefing? Share it:

More briefings

Related posts appear on the live page
Get the briefings first
Breaking security news, verified fast, with the one fact the headlines skip. No spam - unsubscribe anytime.