Four AI Coding Agents Hit by Sandbox Escapes｜Cursor / Codex / Gemini CLI / Antigravity, All via README-Embedded Prompts
TL;DR
Four major AI coding agents — Cursor, Codex, Gemini CLI, Antigravity — hit by sandbox escapes; attackers use README-embedded prompt injection for host RCE.
Pillar Security disclosed on July 22 — Cursor, OpenAI Codex, Google Gemini CLI, and Antigravity all contain sandbox escape vulnerabilities. This is the first multi-vendor simultaneous exposure of the same vulnerability class.
The attack path breaks convention — attackers don't break the sandbox itself. They plant malicious prompts in open-source repo READMEs, Issues, dependencies, or code diffs (indirect prompt injection). The AI agent is tricked into writing seemingly normal config files, virtualenvs, or command scripts into the workspace.
The real vulnerability sits in the trust chain outside the sandbox — the host system's IDE and CLI toolchain (Python interpreter, Git hooks, task runners) periodically read and trust workspace files automatically. Those files, which stayed "inside the box", get loaded and executed outside the sandbox. Attackers achieve arbitrary code execution on the developer's host without ever cracking the isolation layer.
Design blind spots exposed — allowlists check command names but not arguments (Python allowed, script contents unchecked); privileged services outside the sandbox exposed (Git hooks, shell rc files auto-execute on the host). Same design mistake as Adobe Reader's 2012 sandbox escape — different scenario.
Vendor fix progress — Cursor to 3.0.0, Codex CLI to v0.95.0, Gemini CLI patched. Google downgraded both Antigravity issues arguing exploitation requires social engineering to trust malicious repos — a judgment not universally accepted in the industry.
Real threat surface — any GitHub repo with reasonable stars and a legitimate look is exploitable. Dependency confusion attacks amplify 10x in AI agent scenarios — the agent defaults to trusting npm and pip packages and auto-runs build scripts.
Practical guidance — disable auto-approve; don't authorize AI agents to write into ~/.bashrc, ~/.zshrc, .git/hooks/; run AI agents in Docker or dev containers rather than a sandbox.
via BleepingComputer
The attack path breaks convention — attackers don't break the sandbox itself. They plant malicious prompts in open-source repo READMEs, Issues, dependencies, or code diffs (indirect prompt injection). The AI agent is tricked into writing seemingly normal config files, virtualenvs, or command scripts into the workspace.
The real vulnerability sits in the trust chain outside the sandbox — the host system's IDE and CLI toolchain (Python interpreter, Git hooks, task runners) periodically read and trust workspace files automatically. Those files, which stayed "inside the box", get loaded and executed outside the sandbox. Attackers achieve arbitrary code execution on the developer's host without ever cracking the isolation layer.
Design blind spots exposed — allowlists check command names but not arguments (Python allowed, script contents unchecked); privileged services outside the sandbox exposed (Git hooks, shell rc files auto-execute on the host). Same design mistake as Adobe Reader's 2012 sandbox escape — different scenario.
Vendor fix progress — Cursor to 3.0.0, Codex CLI to v0.95.0, Gemini CLI patched. Google downgraded both Antigravity issues arguing exploitation requires social engineering to trust malicious repos — a judgment not universally accepted in the industry.
Real threat surface — any GitHub repo with reasonable stars and a legitimate look is exploitable. Dependency confusion attacks amplify 10x in AI agent scenarios — the agent defaults to trusting npm and pip packages and auto-runs build scripts.
Practical guidance — disable auto-approve; don't authorize AI agents to write into ~/.bashrc, ~/.zshrc, .git/hooks/; run AI agents in Docker or dev containers rather than a sandbox.
via BleepingComputer