"Week of Sandbox Escapes": Cursor, Codex, Gemini CLI, and Antigravity All Breached From Inside (CVE-2026-48124)

Cursor (fixed in 3.0.0), OpenAI Codex CLI (fixed in 0.95.0), Google Gemini CLI, and Google Antigravity

Pillar Security published a one-per-day series showing that sandboxed coding agents do not need to attack the sandbox at all. The agent stays inside the box, obeys every rule, and writes a file that a trusted tool outside the box later runs, loads, or scans, at which point the escape happens on its own. Findings included a workspace-controlled `.claude` hook configuration file in Cursor that becomes unsandboxed command execution (CVE-2026-48124), virtualenv interpreter manipulation exploited through Python extensions, a git metadata bypass of path-based rules, a Codex CLI command allowlist that trusted `git show` by name without validating that the actual invocation was read-only, a Docker socket reachable from Codex, Cursor, and Gemini CLI that offered a privileged local daemon as an unsandboxed execution surface, and two Antigravity issues (a macOS Seatbelt denylist bypass and a `.vscode` task-config bypass of Secure Mode). OpenAI paid a high-severity bounty; Google downgraded both Antigravity findings as difficult to exploit because they need social engineering

Sandbox boundaries are drawn around the agent process but not around the trusted tooling that later consumes the agent's output, so file writes are an unmonitored channel out of the sandbox. Prompt injection hidden in a README or a dependency is enough to aim that channel. Research by Eilon Cohen, Dan Lisichkin, and Ariel Fogel (Pillar Security)