Security researchers have uncovered a new series of vulnerabilities in AI code assistants such as Cursor, OpenAI Codex CLI, Gemini CLI, and Antigravity. The attacks do not directly breach the sandbox in which these tools run; instead, they exploit files created by the AI agent itself, which are later processed by trusted software on the host system.
The researchers at Pillar Security, therefore, do not refer to this as a classic sandbox escape, but rather as a fundamental trust issue. Although the AI agent continues to operate within the sandbox’s constraints, the files it produces can ultimately still lead to code execution outside that protected environment.
According to Pillar Security, the vulnerability lies not so much in the sandbox itself, but in the way development tools handle files from the project environment. Modern development environments constantly perform automated tasks, such as detecting Python interpreters, processing Git metadata, executing VS Code tasks, or communicating with Docker. When an AI agent can modify files trusted by these components, an indirect path to the host system is created.
The researchers demonstrate that an attacker needs only to hide a malicious instruction in, for example, a README file, a software dependency, a Git issue, or a code change. An AI code assistant that processes this information can then generate or modify files that are later automatically executed by other software.
According to the researchers, this shows that a sandbox only provides protection as long as all software outside that sandbox also treats the generated files as untrusted.
Seven vulnerabilities in four AI tools
Pillar Security investigated a total of seven vulnerabilities across four AI code assistants from three vendors. Most of the issues have since been confirmed and resolved.
In Cursor, the researchers discovered, among other things, that a configuration file for Claude hooks could be used to execute commands outside the sandbox. That vulnerability was assigned the identifier CVE-2026-48124 and has been fixed in version 3.0.0. In addition, it turned out that an AI agent could modify a Python virtual environment in such a way that the editor’s Python extension would then automatically execute this modified interpreter. A third vulnerability exploited alternative Git metadata, allowing Cursor’s path-based security to be bypassed.
OpenAI also had to resolve an issue in Codex CLI. There, an allowlist relied exclusively on the name of the `git show` command, even though the parameters used could indeed make changes. OpenAI fixed this in version 0.95.0 and awarded the researchers a bug bounty. A CVE number is still pending.
Another vulnerability affected Cursor, Codex CLI, and Gemini CLI simultaneously. It allowed the AI agents to communicate with a privileged Docker service running outside the sandbox, enabling code to be executed on the host system. This issue has also since been resolved.
Google rates risk lower
Not all vendors assigned the same severity to the findings. According to Pillar Security, Google assigned a lower severity rating to two vulnerabilities in Antigravity. These involved a method to bypass macOS Seatbelt security and an attack via a VS Code task configuration.
According to the researchers, Google stated that both scenarios rely on social engineering or on a developer trusting a malicious repository. As a result, the attacks would be less straightforward to carry out in practice. However, Google reportedly praised the quality of the research.
Well-known attack pattern has broader impact
The underlying attack technique is not entirely new. Earlier this year, Cymulate described a similar method in which configuration files created within a sandbox are later executed outside it.
According to Pillar Security, however, the new research shows that the problem is not limited to a single vendor or a specific implementation. The same fundamental design choice is present in multiple AI code assistants that are now used by many developers.
That is why the company advocates not only securing the sandbox itself but also critically monitoring which local programs execute files created by AI agents. According to the researchers, it is precisely this transition from the sandbox to the trusted development environment that appears to be the weak point in the current generation of AI code-generation tools.