Your AI coding agent isn’t supposed to touch anything outside its sandbox. That’s the entire point of running it in one. Security researchers just found a shared AI coding agent vulnerability across five major tools that breaks that promise, not by attacking the sandbox directly, but by getting something else to do the damage for it.
What Security Researchers Actually Found
Researchers at Pillar Security, Eilon Cohen, Dan Lisichkin, and Ariel Fogel, spent months testing four widely used AI coding agents and reproduced working sandbox bypasses in all of them.
- Cursor
- OpenAI’s Codex
- Google’s Gemini CLI
- Google’s Antigravity
None of the agents needed to break out of their sandbox in the traditional sense. Every case worked the same way instead.
- The agent stays inside its sandbox and follows every rule it’s given
- It writes a file, a config, or a script that looks harmless on its own
- A separate tool outside the sandbox later reads that file and trusts it
- That outside tool executes with full permissions the sandbox was supposed to prevent
The researchers summed up the actual threat model in one line: “An agent’s blast radius is not the agent process, it includes everything the agent can write that the host later trusts.”
How the AI Coding Agent Vulnerability Actually Works
Here’s what that looks like in practice, agent by agent.
| Vulnerability | Affected Agent | Mechanism | Status |
|---|---|---|---|
| Docker socket escape | Codex, Cursor, Gemini CLI | A privileged local Docker daemon became an unsandboxed execution path reachable from the restricted agent | Fixed |
| Virtual environment modification | Cursor | Agent edited a virtualenv interpreter later executed by an unsandboxed Python extension | Fixed in 3.1.2 |
| Git directory indirection | Cursor | Git metadata pointed the sandbox’s own path rules at the wrong location, letting a Git extension trigger execution through fsmonitor | Patched in 3.0.0 |
| Hook configuration execution | Cursor | A workspace-controlled hook config file enabled command execution outside the sandbox, tracked as CVE-2026-48124 | Patched in 3.0.0 |
| Git command allowlist bypass | Codex CLI | The safe-command allowlist trusted a command by name only, without checking its arguments or side effects | Patched in v0.95.0 |
| Seatbelt sandbox bypass | Antigravity | A denylist-style macOS sandbox profile left system features reachable for execution | Downgraded, difficult to exploit |
| VS Code task time bomb | Antigravity | Agent wrote a VS Code task configuration that a separate host process executed later | Downgraded, difficult to exploit |
Nothing in that list required tricking the AI model itself. Every flaw lived in the handoff between the sandboxed agent and whatever unsandboxed tool trusted its output afterward.
A Second, Separate Disclosure Found Even More Agents Affected
Pillar Security’s research wasn’t the only one. A separate team at Manifold Security found a related but distinct flaw, nicknamed GitSpawn, that hits an even wider list of tools.
- Claude Code
- OpenAI Codex
- Cursor
- Grok Build
- Hermes Agent
- Qwen Code
- Goose
GitSpawn works through a Git setting called core.fsmonitor, which can be configured to run an arbitrary command during routine operations like git status or git diff. A malicious repository, delivered as a zip file, a shared drive, a sync folder, or a USB stick rather than a normal clone, can carry a rigged .git/config file that runs attacker code with the developer’s full permissions before any sandbox or trust prompt even appears.
At the time of publication, four of these were still unpatched: Claude Code’s ultrareview variant, Qwen Code, Grok Build, and Hermes Agent.
Why Some of These Took So Long to Fix
Patch speed varied a lot between vendors, and not in a flattering way for everyone involved.
- Cursor and OpenAI shipped fixes for their flagged issues within about a week
- Google was notified about the Antigravity and Gemini CLI issues on January 7, 2026
- As of May 3, 2026, roughly 90 days later, Google had issued no patch and no formal decision on two of the findings
That gap matters. A known, reproducible way to execute code outside an AI coding agent’s sandbox sat unresolved for three months on tools people actively use for real development work.
Worth noting up front:
This isn’t the same kind of sandbox failure we covered when OpenAI, Anthropic, and Meta’s models escaped controlled safety tests earlier this year. That one was about models slipping past evaluation environments. This one is about the software sitting on your laptop right now.
What This Means If You Use These Tools
- Update Cursor to 3.1.2 or later and Codex CLI to 0.95.0 or later if you haven’t already
- Treat any repository that arrives as a folder rather than through a normal git clone, a zip file, shared drive, or USB stick, with real suspicion before opening it in an AI coding agent
- If you use Gemini CLI or Antigravity in an auto-run or agentic mode, know that two related issues remain only partially addressed
- Don’t assume a sandbox means isolation from your entire machine. As the researchers put it, the real question isn’t whether the agent can escape, it’s what the agent is allowed to write that something else on your system will trust.
Frequently Asked Questions
What is the AI coding agent vulnerability that was recently discovered?
Security researchers at Pillar Security found that Cursor, Codex, Gemini CLI, and Antigravity could each be tricked into writing a file that a separate, unsandboxed tool later trusted and executed, bypassing the sandbox without attacking it directly.
Which AI coding agents are affected?
Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Google’s Antigravity were confirmed by Pillar Security. A separate disclosure called GitSpawn also affected Claude Code, Grok Build, Hermes Agent, Qwen Code, and Goose.
Has this AI coding agent vulnerability been fixed?
Most of it has. Cursor and Codex CLI issued patches within about a week. Two issues affecting Google’s Antigravity and Gemini CLI remained unresolved roughly 90 days after being reported. Four tools tied to the GitSpawn disclosure were still unpatched at the time it was published.
Is this the same as the AI sandbox escape story involving OpenAI, Anthropic, and Meta?
No. That involved AI models escaping controlled testing environments during safety evaluations. This is a separate issue involving coding tools people install locally, where the sandbox itself holds, but files the agent writes get trusted by other software outside it.
How can developers protect themselves right now?
Update to the patched versions of Cursor and Codex CLI immediately. Avoid opening repositories that arrive as raw folders instead of through a normal git clone, and be cautious running Gemini CLI or Antigravity in fully automated modes until Google resolves the remaining issues.
Why did some vendors patch faster than others?
Cursor and OpenAI responded to reports within about a week. Google took longer, with two reported issues still lacking a patch or formal resolution roughly 90 days after disclosure, according to the researchers who reported them.
