Cursor, Codex, Gemini CLI Hit by Sandbox Escapes — Patch Now

Four of the most widely-used AI coding assistants — Cursor, OpenAI Codex, Gemini CLI, and Antigravity — have been hit by sandbox escape vulnerabilities, allowing attacker-controlled code to break out of the AI's isolated execution environment and run arbitrary commands directly on a developer's host machine. Multiple CVEs have been assigned and patches are available now.

What Happened

Researchers demonstrated a class of attack that exploits a fundamental trust gap between AI agents and the tooling developers run alongside them: the AI writes files to disk, and trusted host-side tools — build systems, shell scripts, linters, package managers — later execute those files. Because host tooling is implicitly trusted and the AI's sandbox only governs what the agent itself executes, the malicious payload sidesteps containment entirely.

The technique is deceptively simple. A prompt injection or a malicious repository can instruct the agent to write a payload into a Makefile, a .git/hooks/pre-commit, a pyproject.toml script entry, or any other file a developer might trigger without scrutiny. When the developer next runs a build or commit, the host executes the payload outside any AI-imposed restriction.

All four tools received CVE assignments. Google acknowledged the Antigravity findings but downgraded two of them, disputing their severity. The remaining tools have issued patches.

Why This Matters

If you use any of these tools in your daily workflow, your machine has been operating with a broader attack surface than you likely realized. The risk extends well beyond the individual developer:

• Credential theft — agents routinely have access to .env files, SSH keys, and cloud credentials in the working directory. A sandbox escape can exfiltrate all of it silently.
• CI/CD pipeline poisoning — if the agent writes a payload into hook files or build config that gets committed, it propagates to every developer who pulls the branch and every pipeline that runs it.
• Supply chain exposure — in shared or open-source repository contexts, a compromised build file is a dependency-chain attack waiting to trigger downstream.

Critically, this attack requires no vulnerability in the AI model itself. It exploits the trust that human tooling places in files the agent produces. A malicious README.md or an injected code comment is a sufficient entry point — the model just has to be convinced to write a file, which is exactly what developers ask it to do all day.

What To Do

1. Update immediately. Pull the latest versions of Cursor, Codex CLI, and Gemini CLI. Check each tool's release notes for the specific CVE fixes before resuming agentic sessions.
2. Audit your hooks. Run cat .git/hooks/* in active repositories and review any hooks the AI agent may have touched recently.
3. Review build configs. Inspect Makefile, pyproject.toml, package.json scripts, Taskfile.yml, and similar files for unexpected entries — especially in repos where an agent has been active.
4. Restrict agent file-write scope. Where your tool supports it, configure the agent to operate within explicitly scoped directories rather than the full working tree.
5. Review before you run. Before executing any build or test command on a repo the agent has modified, do a git diff pass. This is sound hygiene regardless of this incident.

Google's decision to downgrade two Antigravity findings is worth monitoring — the full BleepingComputer report includes CVE identifiers and individual vendor responses. Patch first, debate severity later.