A major vulnerability has been discovered in four widely used AI coding agents, allowing attackers to bypass their sandbox protections and gain unauthorized access to developers’ machines. The affected tools are Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity, all of which are designed to assist with coding tasks while keeping sensitive information isolated from the rest of the system.
The vulnerability works by exploiting a weakness in how these agents interact with external tools and components. When an agent is given permission to write files within its sandboxed environment, it can inadvertently create executable code that is then picked up by trusted tools outside the sandbox. This allows attackers to inject malicious instructions into the system, potentially leading to unauthorized access or even full control of the machine.
Pillar Security’s research team spent several months studying this issue and published their findings in a series they call “The Week of Sandbox Escapes.” They identified seven distinct bypasses across the four affected tools, which can be broadly categorized into four failure modes. These include sandboxes that are unable to keep pace with the operating system, workspace configurations that masquerade as executable code, “safe” command allowlists that trust a command’s name rather than its arguments, and privileged local daemons that sit outside the sandbox entirely.
Most of the issues have been patched by the vendors, although some fixes are still pending. For example, Cursor was found to be vulnerable due to a .claude hook config that could turn into unsandboxed command execution, which has since been fixed in version 3.0.0. Similarly, Codex CLI was affected by a “safe” command allowlist issue that trusted git show by name while the actual invocation was not read-only.
The discovery of these vulnerabilities serves as a reminder that even with sandbox protections in place, there are still risks associated with using AI coding agents. Pillar’s research highlights the importance of carefully reviewing and testing each layer of security before attackers can exploit these weaknesses. As the report notes, “not whether an agent has a sandbox, but what happens to the files it leaves behind” is the key signal for developers.
Ultimately, this incident underscores the need for continued vigilance and awareness in the development community. By staying informed about emerging threats and vulnerabilities, developers can better protect themselves and their organizations from potential attacks.
Source: Bleeping Computer — 2026-07-20