Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Reproduced cross-vendor sandbox escapes in AI coding agents

Technical Analysis
First reported
Last updated
Happening score
H score 22
1 unique sources, 1 articles

Summary

Hide ▲

Researchers reproduced sandbox-escape bypasses across Cursor, Codex, Gemini CLI, and Antigravity, showing that agentic coding tools can cross the sandbox boundary through trusted host-side workflows. The finding broadens a reusable configuration-based escape pattern across vendors and weakens isolation assumptions for developer environments. The bypasses rely on prompt injection and workspace-controlled files that external tools later run, load, or scan. Several issues were patched, including CVE-2026-48124 in Cursor 3.0.0 and a Codex CLI allowlist bypass in v0.95.0.

Related Happenings

Bandcampro's Gemini CLI-run disposable C&C model for AI-assisted cybercrime

Threat Actor Meta
H score36 First: 20.07.2026 12:07 Last: 20.07.2026 12:07 Sources 1

About this happening: Researchers found bandcampro outsourcing botnet and C&C operations to Google Gemini CLI, turning core operator work into a more disposable and replicable AI-as...

Open Happening

Prompt-injection proof-of-concept enables silent RCE in Claude Code and Codex

Technical Analysis
H score28 First: 10.07.2026 16:45 Last: 10.07.2026 16:45 Sources 1

About this happening: Researchers demonstrated a proof-of-concept exploit that can force remote code execution in Anthropic’s Claude Code and OpenAI’s Codex, exposing a trust-boundary f...

Open Happening

Friendly Fire: autonomous AI code-review modes can execute attacker-controlled repository code

Technical Analysis
H score28 First: 09.07.2026 08:15 Last: 09.07.2026 08:15 Sources 1

About this happening: Friendly Fire shows that autonomous code-review modes in Claude Code and OpenAI Codex can be manipulated into executing attacker-controlled code on the host. The p...

Open Happening

Defensive guidance for splitting behavioral detections around AI coding agents on Windows endpoints

Defensive Guidance
H score28 First: 08.07.2026 20:02 Last: 08.07.2026 20:02 Sources 1

About this happening: AI coding agents on Windows endpoints are triggering attacker-style detections, forcing defenders to separate benign automation from real credential theft risk. A June 2...

Open Happening

HalluSquatting indirect prompt-injection attack on AI coding assistants

Technical Analysis
H score3 First: 08.07.2026 18:07 Last: 08.07.2026 18:07 Sources 1

About this happening: Researchers demonstrated HalluSquatting, an indirect prompt-injection technique that can push AI coding assistants to fetch attacker-controlled resources and execute code....

Open Happening

Timeline

  1. 21.07.2026 00:14 2 articles · 10h ago

    Pillar Security reproduces sandbox escapes in Cursor, Codex, Gemini CLI, and Antigravity

    Technical Analysis Update

    Pillar Security reproduced sandbox-escape bypasses across Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity, showing that files written inside the project workspace can later be run, loaded, or scanned by trusted tools outside the sandbox. The findings center on prompt injection and workspace/config abuse rather than a direct break of the sandbox boundary, and the disclosure notes patched or vendor-acknowledged issues including CVE-2026-48124 in Cursor 3.0.0, a Codex CLI allowlist bypass fixed in v0.95.0, and Google-downgraded Antigravity findings involving macOS Seatbelt and Secure Mode.

    Show sources
    Open in new tab