Trusted Tool Escapes Bypass Sandboxes in Cursor and Codex

On July 20, 2026, researchers from Pillar Security detailed a new class of sandbox escapes affecting Cursor, OpenAI’s Codex, and Google’s Gemini and Antigravity CLIs. The research, titled “The Week of Sandbox Escapes,” demonstrates that securing the boundary between an AI agent and the host operating system is failing at the application logic layer. Rather than breaking out of the sandbox directly, the agents are manipulated into writing malicious configuration files that trusted host developer tools subsequently execute.

The Trusted Tool Attack Vector

The Pillar Security team, consisting of Eilon Cohen, Dan Lisichkin, and Ariel Fogel, identified a consistent architectural flaw across major coding platforms. The attacks begin with prompt injection hidden in malicious README files, open repository issues, or upstream dependencies. Once the agent processes this context, the attacker steers it to write specific configuration files or payloads into the sandboxed workspace.

Traditional sandboxes protect the host by restricting what the agent process can execute. The vulnerability occurs because the host machine inherently trusts the files the agent produces. Trusted local tools, such as background linters, VS Code task runners, or native file system monitors, automatically read the agent-generated files and trigger the execution of the malicious payload outside the sandbox.

Researchers demonstrated this in Google’s Antigravity by injecting execution flags through the find_by_name Pattern parameter. This manipulated the underlying fd utility into arbitrary code execution. If you evaluate and test AI agents, this attack class fundamentally shifts the threat model. An agent’s blast radius is not defined by its execution privileges, but by every file path it can write to.

Platform Vulnerabilities and Patches

The researchers disclosed specific bypasses across four primary targets, resulting in a mix of immediate patches and architectural disputes.

Target	Vulnerability Detail	Status / CVE
Cursor	Workspace-controlled .claude hook triggered unsandboxed command execution.	Patched in v3.0.0 (CVE-2026-48124)
Cursor	Agent edited a virtualenv interpreter run by the editor’s Python extension.	Patched in v3.0.0
Cursor	Exploited Git metadata outside .git to fire execution via fsmonitor.	Patched in v3.0.0 (CVE pending)
Codex CLI	Allowlist trusted git show by name, but lacked read-only enforcement.	Patched in v0.95.0
Antigravity	Bypassed Secure Mode by writing a .vscode task configuration.	Downgraded by Google
Antigravity	Bypassed macOS “Seatbelt” denylist via default policy failure.	Downgraded by Google
Multi-Tool	Privileged Docker socket reachable by agents in Codex, Cursor, and Gemini CLI.	Patched

Google’s Downgrade and Developer Backlash

Google chose to classify the Antigravity findings as “Other valid security vulnerabilities” rather than critical sandbox escapes. The company argued the exploits were difficult to trigger in the wild because they required the attacker to successfully socially engineer the prompt injection step.

This downgrade surfaced as Google forcefully transitions developers from the Gemini CLI to the agent-first Antigravity CLI, which launched as Antigravity 2.0 in May 2026 to handle complex multi-agent routines. The community response has been sharply critical, with developers accusing the company of ignoring insecure Inter-Process Communication (IPC) layers.

This incident aligns with concurrent research from July 2026, including Wiz’s “GhostApproval” and the AI Now Institute’s “Friendly Fire,” which mapped similar trust boundary failures in Claude Code and Amazon Q Developer. As teams increasingly use AI for code review and autonomous generation, the assumption that local tools can safely parse agent-generated files is no longer viable.

When deploying AI coding assistants in your environment, treat the agent’s workspace output strictly as untrusted user input. Disable automatic task execution, background discovery extensions, and pre-commit hooks in directories where autonomous agents operate to sever the execution chain.