Seven Coding-Agent Escapes Show the Sandbox Ends Where Host Trust Begins

2026-07-22 Research by al-ice.ai Editorial

A seven-part disclosure from Pillar Security maps sandbox escapes and boundary bypasses across Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity. The individual mechanisms differ, but the repeated failure is architectural: the agent does not always have to break its own process sandbox. It can write a file, configure a tool, or reach a daemon that a more privileged host component later trusts.

The July 20 research includes two newly published high-severity Cursor advisories, GHSA-p9g2-cr55-cw9mc and GHSA-v4xv-rqh3-w9mc, plus the previously disclosed CVE-2026-48124. It also documents a Codex CLI safe-command bypass patched in v0.95.0, a separate Cursor Git-directory route patched in 3.0.0, and two Antigravity findings that Google accepted as valid security issues but downgraded based on their exploitation preconditions.

These are not seven interchangeable CVEs, and the vendors did not agree on every security boundary. The practical value of the series is broader than its identifiers: it supplies a concrete threat model for any coding agent that combines untrusted repository content, autonomous workspace writes, automatic host-side discovery, and developer credentials on the same endpoint.

The workspace is not inert data

Traditional sandbox policy often treats writes inside the selected project as low risk. Agentic development breaks that assumption because a modern workspace contains executable control planes: Git configuration, editor tasks, lifecycle hooks, language environments, build files, and tool-specific settings.

One Cursor chain let an agent alter a Python virtual environment inside the workspace. Cursor’s bundled Python extension then ran the apparent interpreter during automatic discovery from the unsandboxed extension host. The Cursor advisory says the malicious wrapper could execute host commands with the user’s privileges, modify files beyond the workspace, and launch applications. Cursor versions before 3.1.2 are affected according to GHSA-p9g2-cr55-cw9c.

A second Cursor route used Git’s ability to keep repository metadata somewhere other than a literal .git directory. Path rules guarded the familiar .git/config, but an alternate Git directory could hold an fsmonitor helper. When the editor’s Git integration detected and inspected the repository, Git executed that helper outside the agent sandbox. Pillar says Cursor patched this path in 3.0.0; a CVE was still pending at publication.

The already assigned CVE-2026-48124 follows the same handoff. Cursor 2.4.37 could consume a workspace-defined .claude/settings.local.json hook and run its command at the end of an agent turn without a dedicated approval. Cursor’s advisory rates the issue High and lists 3.0.0 as the patched version. The fix brings workspace hook commands under the approval and execution-policy controls applied to other agent shell commands.

A “safe” command became an unsandboxed write primitive

The Codex CLI finding targeted an approval optimization rather than the filesystem sandbox itself. Codex treated git show as safe enough to execute without approval, but Git’s argument surface allows that subcommand to write formatted output to a chosen path. Pillar used those options to place attacker-controlled Git configuration in the repository and arrange code execution when a later Git operation consumed it.

This matters because the allowlist was a deterministic bypass around the deterministic controls. If a model followed an injected instruction, neither a refusal policy nor a sandbox prompt remained in the path. Pillar reports that OpenAI rated the issue at CVSS 8.6 during private handling, patched it in Codex CLI v0.95.0, and had not assigned a CVE when the research was published. The corresponding rust-v0.95.0 tag is present in OpenAI’s public Codex repository.

Command names are too coarse a security unit for utilities such as Git, tar, rsync, and package managers. Their flags can change a read operation into a write, load configuration, invoke helpers, or trigger hooks. An agent approval policy has to evaluate the full invocation and its possible effects—not merely the first two words.

Docker Desktop moved execution outside three sandboxes

Pillar reproduced another chain in Cursor, Codex CLI, and Gemini CLI on macOS systems with Docker Desktop available. A sandboxed agent that could reach Docker could ask the privileged daemon to create a container, then use Docker Desktop’s VirtioFS host-sharing mechanism from that separate execution environment. The daemon, not the restricted agent process, performed the consequential host access.

Cursor published GHSA-v4xv-rqh3-w9mc, rates its variant High, and describes Auto-Run Sandbox mode combined with Docker Desktop and the Dev Containers CLI. The advisory lists Cursor before 3.0.0 as vulnerable. Pillar says Cursor changed the behavior so the Docker socket no longer reproduced as an in-sandbox path.

The same report records different outcomes elsewhere. OpenAI considered the Codex route environment- and configuration-dependent because Unix-socket access is denied unless allowed in the active network profile; it paid the report but classified it as informational and declined a CVE. The Gemini CLI team pointed to documentation of Docker sandbox risk rather than treating the condition as a product vulnerability. Operators should preserve that distinction: the research demonstrates a reachable trust bridge under stated configurations, not a universal default escape in every installation.

Antigravity exposed both policy and delayed-execution gaps

The first Antigravity finding examined build 1.15.8 on macOS. Its Seatbelt profile began from allow default and subtracted disallowed operations. Pillar combined an omitted mount restriction with Launch Services behavior to start a fresh process outside the profile. The reported preconditions included Secure Mode being off, terminal sandboxing being on, and command auto-execution set to “Always Proceed.”

The second did not require a classic process breakout. The agent wrote a VS Code task configuration while sandboxed; later, a host-side watcher launched the task outside that sandbox. That is delayed execution across a trust boundary—the same class of problem visible in hooks, interpreter discovery, and Git helpers.

Pillar’s master report says Google accepted both as valid security findings, praised the report quality, and categorized them as “Other valid security vulnerabilities,” while downgrading them because exploitation depended on social engineering or trusting a repository carrying indirect prompt injection. The public research does not identify a patched Antigravity version, so defenders should not invent one from the disclosure alone.

Defensive engineering guidance

Patch the confirmed product issues. Move Cursor to at least 3.1.2 to cover the virtual-environment advisory as well as fixes shipped in 3.0.0. Move Codex CLI to v0.95.0 or later for the reported git show allowlist flaw.
Do not grant Docker access by convenience. Treat the Docker socket and equivalent local daemon APIs as privileged host control. Deny agent access unless the workflow explicitly needs it; isolate required build daemons from the developer’s home directory and credentials.
Put host readers under the same trust policy as agent writers. Interpreter discovery, Git scanning, task runners, hooks, language servers, and build watchers should not automatically execute artifacts created or modified during an agent session.
Review executable workspace state. Alert on agent-originated changes to .vscode, .claude, Git configuration or alternate Git directories, virtual-environment executables, hooks, task files, and package-manager scripts.
Model invocations, not binaries. Approval bypasses should account for flags, paths, configuration sources, current directory, environment, and side effects. A binary with a read-oriented subcommand is not inherently read-only.
Prefer deny-by-default containment. A blocklist profile must anticipate every useful operating-system primitive. Keep the process policy narrow, remove unnecessary network and socket access, and use stronger VM or container boundaries for untrusted autonomous work.
Separate secrets from agent endpoints. Keep publishing tokens, cloud credentials, SSH keys, browser sessions, and production access out of the environment whenever the agent processes untrusted repositories or web content.
Preserve provenance and telemetry. Record which files an agent wrote and which unsandboxed components later read or executed them. Process-only monitoring misses the decisive handoff in several of these chains.

The core lesson is not that sandboxes are useless. It is that the advertised boundary has to include every system that acts on agent-controlled output. A sandbox can correctly deny a direct write to a home directory while an extension, hook engine, Git helper, task watcher, or Docker daemon completes the same operation outside it. Security testing for coding agents must therefore follow trust across time and process boundaries—from untrusted input, to model action, to workspace artifact, to the host component that consumes it.

Sources: