Cursor, Codex, Gemini CLI, and Antigravity AI coding tools vulnerable to sandbox escape attacks
Popular AI coding assistants allow attackers to escape security sandboxes by writing files that host tools later execute, potentially compromising developer workstations.
How the attacks work
Security researchers discovered that multiple AI coding assistants fail to properly isolate agent-generated code from the host system. The vulnerability occurs when AI agents write configuration or script files that trusted host tools automatically execute, breaking out of their intended security boundaries.
The attack surface includes popular development tools like Cursor, Codex, Gemini CLI, and Antigravity. Each tool has received patches, though Google downgraded the severity of two findings in Antigravity. Multiple CVE identifiers have been assigned to track the distinct vulnerabilities.
Implications for AI-assisted development
The findings highlight a fundamental tension in AI coding tools: giving agents enough system access to be useful while preventing malicious behavior. As these tools become more autonomous, the attack surface expands beyond traditional code injection to include configuration manipulation and toolchain exploitation.
Developers using AI coding assistants should verify that their tools have received security updates. Organizations may need to reconsider which AI agents run with elevated privileges or access to sensitive codebases until isolation mechanisms mature.