Security firm Pillar Security on Monday, July 20, published "The Week of Sandbox Escapes" — a disclosure series showing that four of the most widely used AI coding agents, Cursor, OpenAI Codex CLI, Google Gemini CLI and Google Antigravity, could be escaped by attackers without ever breaking the sandbox itself.
The trick: write the future
Researchers Eilon Cohen, Dan Lisichkin and Ariel Fogel found a common pattern: the sandboxed agent writes a file or configuration that a trusted component outside the sandbox later runs, loads or scans. As Pillar puts it: "If an agent gets to write the future inputs of systems, it was never sandboxed in the first place." A poisoned repo or an indirect prompt injection is enough to get the agent to plant the payload.
The specific holes
Highlights from the series: an exposed Docker socket reachable from inside the sandbox hit Codex, Cursor and Gemini CLI at once (GHSA-v4xv-rqh3-w9mc). Cursor's support for .claude hook configs allowed unsandboxed command execution (CVE-2026-48124, fixed in Cursor 3.0.0), alongside a Python venv interpreter swap and a git fsmonitor trick. In Codex CLI, the "GitPwned" bypass abused the allowlist trusting git show by name while the invocation was not actually read-only — patched in v0.95.0, with OpenAI paying a high-severity bounty. On Antigravity, Pillar demonstrated a macOS Seatbelt denylist bypass and a VS Code task-injection path.
Vendors split on severity
Cursor and OpenAI shipped fixes and acknowledged the findings. Google classified the two Antigravity issues as "other valid security vulnerabilities" and downgraded them as hard to exploit, since they require a user to open a malicious repository — meaning those paths were acknowledged but not fully patched.
A drip of deep-dives
Pillar is releasing one technical write-up per day this week, so the full exploit details are still landing — and with millions of developers running these agents on corporate machines, the patch-now guidance applies before the write-ups finish.