Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
Summary
Security researchers discovered sandbox escape vulnerabilities in four popular AI coding agents (Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity) by exploiting a fundamental design flaw: these tools trust files written by the sandboxed agent and automatically execute them through external tools like Git integrations and task runners. The attacks use prompt injection (tricking an AI by hiding malicious instructions in files like READMEs or code dependencies) to make the agent write files that trigger unsandboxed command execution on the developer's machine without the agent itself breaking out of the sandbox.
Solution / Mitigation
Most issues have been patched by vendors. Cursor fixed multiple vulnerabilities in version 3.0.0 (including a .claude hook config execution flaw and Git metadata bypass). OpenAI patched Codex CLI's 'safe' command allowlist bug in v0.95.0. The Docker socket vulnerability affecting Codex, Cursor, and Gemini CLI is now fixed. According to Pillar Security, the underlying fix involves monitoring the moment a trusted local tool runs something the agent wrote, rather than simply banning filenames.
Classification
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/
First tracked: July 20, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 92%