// NEXUSVOID CYBER NEWS
<- ALL CYBER NEWS
High
AI agents, Cursor, Codex, Gemini CLI, Antigravity, sandbox escape, CVE-2026-48124, prompt injection
AI Coding Agent Sandbox Escapes Hit Cursor, Codex
AI coding agent sandbox escapes in Cursor, Codex, Gemini CLI and Antigravity let the agent write files trusted host tools then run (CVE-2026-48124). Patch now.
Published July 21, 2026.
Security researchers escaped the sandboxes of Cursor, OpenAI Codex, Google Gemini CLI and Antigravity by having the AI agent write files that trusted host tools later run — the agent stays boxed, but its output does not. The core Cursor flaw is tracked as CVE-2026-48124 and fixed in v3.0.0; update your AI coding tools and treat agent-written files as untrusted.
What happened. Pillar Security's team (Eilon Cohen, Dan Lisichkin and Ariel Fogel) disclosed a series of sandbox escapes across major AI coding tools as part of a "Week of Sandbox Escapes." The shared root cause: the agent stays sandboxed, but the files it writes are trusted by tools outside the box. An attacker plants malicious instructions in content the agent will process — a README, a dependency, a diff — and the agent writes configuration or hook files that an external, unsandboxed tool then executes without re-validation. In effect, the sandbox contains the agent but not its side effects. The core Cursor flaw is catalogued as CVE-2026-48124.
Which AI coding tools are affected?
Tool | Issue | Fix |
|---|---|---|
Cursor |
| v3.0.0 |
OpenAI Codex CLI | Git command allowlist bypass (CVE pending) | v0.95.0 |
Gemini CLI | Docker-socket privilege-escalation variant of CVE-2026-48124 | Vendor update |
Antigravity | Two findings Google classified as "other valid" (require social engineering) | Vendor update |
How does the sandbox escape work?
The agent is confined, but the artifacts it produces are not. Malicious text injected into a repository (README, dependency manifest, or diff) steers the agent into writing a hook, config, or interpreter file. A trusted host tool — the editor, a Git hook, a Docker socket, or a package interpreter — then runs that file with the developer's own privileges. No exploit of the model itself is needed; the gap is the trust boundary between "sandboxed agent output" and "host tool input."
What to do now.
Update Cursor to v3.0.0 and Codex CLI to v0.95.0, and apply the latest Gemini CLI and Antigravity releases.
Treat agent-written files as untrusted: review hook, config, and CI files an agent creates before any host tool runs them.
Run coding agents with least privilege — no host Docker-socket access, scoped Git allowlists, and no ambient credentials the agent does not need.
Assume malicious content in repos: untrusted READMEs, issues, and dependencies are prompt-injection surfaces.
Who's affected. Developers and teams running Cursor, OpenAI Codex CLI, Google Gemini CLI, or Antigravity with agentic (file-writing) features enabled, especially against untrusted repositories.
Our read. This is the AI-agent attack surface we keep pointing at: the model can be perfectly "aligned" and still be the delivery mechanism, because the exploit lives in the trust boundary around it, not in the model. A capability that only shows up when a real adversary feeds the agent hostile input is exactly what supervised adversary simulation is for — you cannot find a trust-boundary escape by asking the agent nicely; you find it by having someone try to break out. Patching the four named tools closes today's holes; treating every agent-written file as untrusted closes the class.
Reporting by BleepingComputer; vulnerability detail and disclosure per Pillar Security. Sources linked above. Related: our supervised adversary simulation approach.