Four major AI coding agents—Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity—have been compromised through sandbox escape vulnerabilities that exploit a fundamental architectural weakness: the trust boundary between sandboxed agents and the tools that run outside the box. Pillar Security's research team demonstrated that these escapes don't require direct attacks on the sandbox itself. Instead, malicious instructions planted in files (READMEs, dependencies, diffs) that the agent is permitted to write get executed by trusted external tools—Python extensions, Git integrations, VS Code task runners, Docker daemons—that automatically read and act on those files. The vulnerability class, termed "Configuration-Based Sandbox Escape," stems from four failure modes: denylist sandboxes that cannot keep pace with workspace configurations, executable code masquerading as configuration, command allowlists that trust command names rather than arguments, and privileged local daemons sitting entirely outside the sandbox. Most vendors have patched their implementations, though Google downgraded its two findings as difficult to exploit, citing the need for social engineering or user trust in compromised repositories.
The implications for CX teams evaluating agentic tools are material. If your organisation is considering AI-assisted coding agents for internal development or customer-facing automation—whether through Cursor, Codex, or similar platforms—you cannot treat sandbox isolation as a security guarantee. The breadth of this vulnerability across three vendors and four tools signals a systemic design problem rather than isolated implementation flaws. For teams already running or planning to deploy agentic systems, the question becomes whether your threat model accounts for prompt injection attacks arriving through seemingly benign configuration files or repository metadata, and whether your security operations can detect when external tools execute code written by sandboxed agents. The fix, as Pillar notes, is not another filename denylist but rather monitoring the moment trusted local tools execute agent-written content—a detection layer that most organisations currently lack.
Researchers escaped the sandboxes in Cursor, Codex, Gemini CLI and Antigravity by having the AI agent write files that trusted host tools later run. Multiple CVEs, patches, and Google downgrading two Antigravity findings. [...]