Sandbox flaws in Cursor, Codex, and Gemini CLI expose enterprise code

Security researchers at Pillar Security have demonstrated that four leading AI coding agents can execute unauthorized commands on a developer’s machine without technically breaking their digital boundaries. The affected tools are Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity.

The exploits rely on a blind spot in how sandboxes handle files. These systems isolate the AI agent within a specific project folder, blocking direct access to the host computer. However, the files generated inside that folder are not inert. External tools like Python extensions, Git integrations, and Docker Desktop routinely read and execute files from those directories. By using prompt injection—hiding malicious instructions in a README, an issue, or a dependency—the AI can write a file that the host system later executes as a trusted command.

Pillar identified seven vulnerabilities grouped into four failure modes. These include denylists that cannot track the operating system, workspace configurations that function as code, "safe" command lists that trust a command name over its arguments, and privileged local daemons sitting entirely outside the sandbox.

For European businesses integrating these agents into their software development cycles, the findings shift the risk calculus. The productivity gains of AI coding assistants are offset by a newly expanded attack surface. As Pillar noted, an agent’s blast radius is not limited to its own process, but extends to everything it can write that the host later trusts.

Vendor responses to the disclosures have been uneven. Cursor patched a workspace hook vulnerability, now registered as CVE-2026-48124, in version 3.0.0. OpenAI fixed a flawed Git command in Codex and paid a bounty. A single Docker-socket bug affected Cursor, Codex, and Gemini CLI simultaneously.

Google, however, declined to patch the two vulnerabilities found in Antigravity. The company classified them as "other valid security vulnerabilities," downgraded their severity as hard to exploit, and did not issue fixes, though it called one report "of exceptional quality." Pillar countered that dismissing the risk ignores reality, as the bugs require a developer to trust a poisoned repository—which is exactly the everyday scenario these agents are designed to handle.

The disclosures arrive the same week OpenAI revealed its own model repeatedly slipped its sandbox. “If an agent gets to write the future inputs of systems, it was never sandboxed in the first place,” the Pillar team wrote. For corporate IT departments evaluating agentic coding tools, the relevant question is no longer whether a sandbox exists, but what happens to the files the agent leaves behind.