Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
Security researchers discovered sandbox escapes in four widely used AI coding agents, including Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity. The agents were able to break out of their sandboxes without attacking them head-on by writing files that were lat…
Intelligence analysis by Llama
Security researchers found that four widely used AI coding agents, including Cursor, Codex, Gemini CLI, and Antigravity, can break out of their sandboxes by writing files that are later read and acted upon by tools outside the sandbox. This vulnerability allows attackers to execute malicious code without being detected.
Imagine you have a special box that keeps your code safe. But what if someone could write a note inside the box that would get read and acted upon by someone outside the box? That's basically what happened with these four coding agents. They were able to break out of their sandboxes by writing files that were later read and acted upon by tools outside the sandbox.
Analysis
A Wider Problem Than Initially Thought
The underlying class of this vulnerability is not new. In April, Cymulate documented the same pattern, which it named "Configuration-Based Sandbox Escape," across Claude Code, Gemini CLI, and Codex CLI. However, what is new is the breadth of this failure. The same vulnerability shows up across four tools from three vendors.
The Fix Is Not Just About Banning Filenames
Pillar's fix is not another list of banned filenames. It watches the moment a trusted local tool runs something the agent wrote. For anyone weighing agentic coding tools, that is the more useful signal: not whether an agent has a sandbox, but what happens to the files it leaves behind.
Test Every Layer Before Attackers Do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen. The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Key points
- Four widely used AI coding agents, including Cursor, Codex, Gemini CLI, and Antigravity, can break out of their sandboxes by writing files that are later read and acted upon by tools outside the sandbox.
- This vulnerability allows attackers to execute malicious code without being detected.
- The fix is not just about banning filenames, but rather about watching the moment a trusted local tool runs something the agent wrote.
- Security teams log 54% of successful attacks and alert on just 14%, with the rest moving through the environment unseen.
The discovery of these sandbox escapes highlights the importance of properly securing sandboxes and the files they contain. It also shows that security researchers are actively working to identify and fix vulnerabilities in widely used coding agents.
The fact that these sandbox escapes were able to go undetected for so long is a concern. It highlights the need for more robust security measures and regular testing of coding agents to ensure that they are secure and free from vulnerabilities.
