Sandbox escapes in Cursor, Codex, Gemini CLI, and Antigravity expose AI coding tools to host attacks

Security researchers have demonstrated sandbox escape vulnerabilities in four widely used AI coding agents: Cursor, OpenAI's Codex CLI, Google Gemini CLI, and Antigravity. The attacks, reported in late July 2026, bypass the intended isolation boundaries by having the AI write files that the host's trusted tools later execute.

Multiple CVEs were assigned for the vulnerabilities, and Google separately downgraded two of the Antigravity findings after reviewing the severity. Most of the flaws have been patched by the respective vendors.

How the sandbox escapes worked

The researchers exploited a fundamental trust relationship between the AI agent and the host environment. AI coding tools typically run inside a sandbox to prevent malicious code from affecting the underlying system. However, the agents are allowed to write files to disk, and the host machine's shell, editor, or package manager may automatically execute files in certain locations.

By crafting a malicious file that the host's trusted tool later loads or runs, the researchers broke out of the sandbox. The attack does not require any vulnerability in the AI model itself, only in the way the tool is integrated with the host.

• Cursor, vulnerability patched in version 0.45.x; users should update immediately.
• OpenAI Codex CLI, fix released in July 2026; advisory recommends upgrading to the latest build.
• Google Gemini CLI, patched via a server-side update; no client action required.
• Antigravity, two findings downgraded by Google after re-evaluation; patches issued for remaining issues.

Implications for AI tool security

The attacks highlight a broader design challenge. AI coding agents are granted write access to the filesystem so they can generate code, but that same capability can be turned against the host. The researchers note that the attack surface is not limited to the four tools; any agent that writes files to paths later consumed by trusted host software could be vulnerable.

Vendors have responded with patches, and the researchers have published their findings to encourage similar scrutiny of other tools. Users are advised to update their AI coding tools immediately and to consider running them inside additional isolation layers, such as dedicated virtual machines or containers with restricted filesystem mounts.

Google, which developed both Gemini CLI and Antigravity, said it had downgraded two Antigravity issues because they required a higher privilege level than initially assessed. The company still recommended that users apply the latest updates.

As AI coding tools become more integrated into developer workflows, the boundary between agent and host will remain a critical security frontier. The researchers plan to present their methodology at a security conference later this year.