Threat · curated 20 Jul 2026
The Week of Sandbox Escapes
First reported pillar.security
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
AI coding agents are widely deployed with developer-level access, and these escapes show that indirect prompt injection can turn a 'contained' agent into host code execution without ever attacking the sandbox directly.
Pillar Security researchers demonstrated seven sandbox-escape techniques against four AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — where a sandboxed agent writes workspace files that trusted tools running outside the sandbox (Python extensions, Git integrations, hook engines, Docker daemons) later execute. Prompt injection planted in a README, issue, dependency, or diff triggers local command execution on the developer's machine; one Cursor flaw is tracked as CVE-2026-48124 and fixed in version 3.0.0, with most issues patched and vendor-acknowledged.
Summary
Pillar Security's research team publicly disclosed seven vulnerabilities across four widely used AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — under a daily series called the Week of Sandbox Escapes. Rather than attacking the sandbox directly, the researchers demonstrated that a sandboxed agent can obey every rule while writing files that trusted tools outside the sandbox later run, load, or scan, converting a permitted file write into host code execution.[1][2]
The trigger is prompt injection: a malicious instruction planted in a README, an issue, a dependency, or a diff becomes a local action on the developer's machine. Pillar sorts the findings into four failure modes — denylist sandboxes that cannot keep pace with the OS, workspace config that is really executable code, 'safe' command allowlists that trust a command's name rather than its arguments, and privileged local daemons sitting outside the sandbox entirely.[1]
Most issues are patched and vendor-acknowledged, including a Cursor bug tracked as CVE-2026-48124 (fixed in 3.0.0) and a Codex CLI allowlist bug fixed in v0.95.0. The class is not new — Cymulate documented the same 'Configuration-Based Sandbox Escape' pattern in April — but the notable new signal is its breadth across four tools from three vendors.[1]
Attack chain
- Injection / Initial trigger: A malicious instruction (indirect prompt injection) is planted in content the agent processes — a README, an issue, a dependency, or a diff.[1]
- In-sandbox file write: The sandboxed agent, obeying its rules, writes or edits a file inside the trusted project workspace (e.g., a .claude hook config, a virtualenv interpreter, Git fsmonitor metadata, or a .vscode task file).[1]
- Out-of-sandbox execution: A trusted tool running outside the sandbox — a Python extension resolving interpreters, a Git integration scanning the repo, VS Code running task files, a hook engine, or Docker Desktop's local socket — reads or acts on the agent-written file, executing code on the host.[1]
Disclosure timeline
| Date | Event |
|---|---|
| April 2026 | Cymulate documents the same pattern, named 'Configuration-Based Sandbox Escape,' across Claude Code, Gemini CLI and Codex CLI.[1] |
| July 20, 2026 | Pillar Security publishes the Week of Sandbox Escapes series and BleepingComputer reports the seven findings across four AI coding agents.[1][2] |
How it works
The sandboxes draw a trust line: the agent is trusted inside the project workspace while the host outside is protected. The flaw is that files inside the workspace are not inert — tools running outside the sandbox read and act on them, so a file the agent is allowed to write can turn into a command the host later runs.[1]
IDEs and CLI agents constantly run their own tools outside the sandbox: Python extensions resolving interpreters, Git integrations scanning repos, VS Code running task files, hook engines firing commands, and Docker Desktop exposing a local socket. A sandboxed agent can obey every rule and still shape the files those components read.[1]
Concrete instances: a Cursor .claude hook config became unsandboxed command execution (CVE-2026-48124); a second Cursor bug let the agent edit a virtualenv interpreter the Python extension then ran during discovery; a third abused Git metadata not needing to live in a folder called .git, firing execution through fsmonitor to slip past Cursor's path-based rules; a Codex CLI allowlist trusted 'git show' by name while the actual invocation was not read-only; and a Docker socket exposed a privileged local daemon the agents could reach.[1]
The two Antigravity findings were a macOS Seatbelt denylist bypass and a .vscode task-config bypass of its Secure Mode.[1]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Cursor (.claude hook config command execution, CVE-2026-48124) | Versions before 3.0.0 | Fixed in version 3.0.0[1][2] |
| Cursor (Git fsmonitor path-rule bypass) | Versions before 3.0.0 | Patched in 3.0.0, CVE pending[1] |
| Cursor (virtualenv interpreter execution via Python extension) | Cursor with Python extension interpreter discovery | Vendor-acknowledged and patched per report[1] |
| OpenAI Codex CLI (git show allowlist bypass) | Versions before v0.95.0 | Patched in v0.95.0; high-severity bounty paid, CVE pending[1] |
| Codex, Cursor and Gemini CLI (Docker socket / privileged local daemon) | All three agents reachable to the local Docker daemon | Fixed[1] |
| Google Antigravity (macOS Seatbelt denylist bypass and .vscode Secure Mode bypass) | Antigravity on macOS | Classified by Google as 'Other valid security vulnerabilities' and downgraded[1] |
Key takeaways
- The vulnerability class is a design pattern, not a single bug: sandboxes trust files inside the workspace as inert, but trusted tools outside the sandbox execute them, so obeying every sandbox rule is not sufficient to prevent host compromise.[1]
- The pattern is not new — Cymulate documented 'Configuration-Based Sandbox Escape' in April — but its breadth across four tools from three vendors is the more useful signal when evaluating agentic coding tools.[1]
- The four recurring failure modes are denylist sandboxes that lag the OS, workspace config that is executable code, allowlists that trust command names over arguments, and privileged local daemons outside the sandbox.[1]
Defensive actions
- Update the affected AI coding agents to patched releases — Cursor 3.0.0 and Codex CLI v0.95.0.: These versions fix the disclosed sandbox-escape vulnerabilities, including CVE-2026-48124 and the Codex git show allowlist bypass.[1][2]
- Treat repositories, issues, dependencies and diffs opened in agentic coding tools as untrusted input capable of indirect prompt injection.: Prompt injection planted in such content is the trigger that turns an in-sandbox file write into host code execution.[1]
- Monitor the moment a trusted local tool runs something the agent wrote, rather than relying on lists of banned filenames.: Pillar's recommended fix targets the execution event because denylist sandboxes cannot keep pace with the operating system.[1]