{"data":{"id":"ad28ef4e-2dac-421b-b3b0-249c03ea693f","title":"Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes","summary":"Security researchers discovered sandbox escape vulnerabilities in four popular AI coding agents (Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity) by exploiting a fundamental design flaw: these tools trust files written by the sandboxed agent and automatically execute them through external tools like Git integrations and task runners. The attacks use prompt injection (tricking an AI by hiding malicious instructions in files like READMEs or code dependencies) to make the agent write files that trigger unsandboxed command execution on the developer's machine without the agent itself breaking out of the sandbox.","solution":"Most issues have been patched by vendors. Cursor fixed multiple vulnerabilities in version 3.0.0 (including a .claude hook config execution flaw and Git metadata bypass). OpenAI patched Codex CLI's 'safe' command allowlist bug in v0.95.0. The Docker socket vulnerability affecting Codex, Cursor, and Gemini CLI is now fixed. According to Pillar Security, the underlying fix involves monitoring the moment a trusted local tool runs something the agent wrote, rather than simply banning filenames.","labels":["security"],"sourceUrl":"https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/","publishedAt":"2026-07-20T21:14:42.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection","supply_chain"],"issueType":"news","affectedPackages":null,"affectedVendors":["OpenAI","Google","Anthropic"],"affectedVendorsRaw":["Cursor","OpenAI Codex","Google Gemini CLI","Antigravity","Claude Code"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-07-20T21:14:42.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}