Sandbox escapes in Cursor, Codex, Gemini CLI, and Antigravity let agents run code

Researchers at Pillar Security demonstrated sandbox escapes across four widely used AI coding agents: Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity. In nearly every case the agent never broke the sandbox directly; it only had to write a file that a trusted component outside the sandbox would later run, load, or scan. Failure modes included hook abuse, editing a virtual environment interpreter the editor then ran itself, planting Git metadata outside a .git folder to fire execution through fsmonitor, and a command allowlist that trusted a tool by name while the real invocation was not read only. Prompt injection in workspace content was the trigger.

Check

Update Cursor to 3.0.0 or later and Codex CLI to 0.95.0 or later, then check whether coding agents can reach a Docker socket or other privileged local daemon.

Affected

Developers running AI coding agents on untrusted repositories; prompt injection in workspace content can make the agent write files that trusted tools outside the sandbox later execute, defeating the sandbox.

Fix

Patch the affected agents, treat repository content as untrusted input, keep privileged daemons and sockets out of agent reach, and do not rely on a workspace sandbox as your only boundary.