AI Coding Agent Sandbox Escapes: Cursor, Gemini CLI & More

Security researchers have found ways to escape the sandboxes of four widely used AI coding agents, including Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity. These escapes did not attack the sandbox directly. Here's the thing: the agent stays within its rules and writes a file. Then, a trusted tool outside the sandbox runs, loads, or scans that file, and the escape happens. This is because tools running outside the sandbox read and act on files within the workspace. A file the agent is allowed to write can become a command the host later runs. Prompt injection is the trigger. A malicious instruction in a file like a README can become a local action on the developer's machine. The researchers identified four failure modes, including denylist sandboxes that can't keep up with the operating system and "safe" command allowlists that trust a command's name, not its arguments. What's interesting is that most of these issues are now patched and acknowledged by vendors. For example, a Cursor bug that allowed unsandboxed command execution is tracked as CVE-2026-48124 and fixed in version 3.0.0. The bottom line is that even with sandboxes, indirect methods can lead to security vulnerabilities in AI coding tools.