Executive Summary
In July 2026, security researchers identified vulnerabilities in four widely used AI coding agents—Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity—that allowed sandbox escapes without direct attacks on the sandboxes themselves. By writing files that trusted tools outside the sandbox later executed, the agents could perform unauthorized actions on the host system. This method exploited the trust between sandboxed environments and external tools, leading to potential security breaches.
The discovery underscores the evolving nature of threats targeting AI development tools. As these tools become more integrated into software development workflows, ensuring their security is paramount. Organizations must remain vigilant, regularly updating and auditing their development environments to mitigate such risks.
Why This Matters Now
The incident highlights the critical need for robust security measures in AI development tools, as attackers increasingly exploit trust relationships between sandboxed environments and external tools, posing significant risks to software development workflows.
Attack Path Analysis
Attackers exploited sandbox vulnerabilities in AI coding agents by crafting malicious files that, when processed by trusted tools outside the sandbox, led to unauthorized code execution on the host system. This method allowed them to escalate privileges, move laterally, establish command and control channels, exfiltrate sensitive data, and potentially disrupt operations.
Kill Chain Progression
Initial Compromise
Description
Attackers crafted malicious files within the sandboxed environment of AI coding agents, exploiting the trust between the sandbox and external tools.
Related CVEs
CVE-2026-48124
CVSS 8.5Cursor versions prior to 3.0.0 allow execution of workspace-defined Claude hook commands without user approval, enabling sandbox escape and potential local command execution.
Affected Products:
Cursor Cursor – < 3.0.0
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Virtualization/Sandbox Evasion
Escape to Host
Command and Scripting Interpreter
Exploitation for Client Execution
Impair Defenses
Valid Accounts
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Change Control Processes
Control ID: 6.4.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Security Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI coding agents like Cursor, Codex, and Gemini CLI sandbox escapes expose development environments to prompt injection attacks, compromising software supply chains.
Information Technology/IT
Sandbox escape vulnerabilities in AI development tools create lateral movement risks across IT infrastructure through compromised workspace configurations and privileged daemon access.
Computer/Network Security
Security teams face challenges detecting AI agent sandbox escapes that bypass traditional security controls through configuration-based attacks and trusted tool exploitation.
Financial Services
AI coding tool vulnerabilities threaten financial software development environments, potentially compromising secure applications handling sensitive customer data and regulatory compliance requirements.
Sources
- Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapeshttps://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/Verified
- Cursor Desktop sandbox escape via Claude hook configurationhttps://github.com/cursor/cursor/security/advisories/GHSA-pc9j-3qc2-95wvVerified
- CVE-2026-48124: Cursor Code Editor RCE Vulnerabilityhttps://www.sentinelone.com/vulnerability-database/cve-2026-48124/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it can limit unauthorized code execution and lateral movement by enforcing strict workload isolation and identity-aware routing, thereby reducing the attacker's ability to escalate privileges and exfiltrate data.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The CNSF would likely limit the execution of malicious files by enforcing strict workload isolation, reducing the attacker's ability to exploit trust relationships between sandboxed environments and external tools.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation would likely limit unauthorized code execution by enforcing strict identity-based access controls, reducing the attacker's ability to escalate privileges on the host system.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security would likely limit lateral movement by enforcing strict segmentation policies, reducing the attacker's ability to access additional systems and resources.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility & Control would likely limit the establishment of command and control channels by providing comprehensive monitoring and control over network traffic, reducing the attacker's ability to maintain persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement would likely limit data exfiltration by enforcing strict outbound traffic policies, reducing the attacker's ability to transfer sensitive data to external servers.
The CNSF would likely limit operational disruption by containing the attacker's activities to the initially compromised workload, reducing the scope of potential damage to critical data and systems.
Impact at a Glance
Affected Business Functions
- Software Development
- Code Review
- Continuous Integration
Estimated downtime: 2 days
Estimated loss: $50,000
Potential exposure of source code and intellectual property.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce strict access controls and limit the impact of potential breaches.
- • Enhance East-West Traffic Security to monitor and control internal traffic, preventing unauthorized lateral movement.
- • Deploy Egress Security & Policy Enforcement to restrict unauthorized outbound communications and data exfiltration.
- • Utilize Multicloud Visibility & Control to gain comprehensive insights into network activities across cloud environments.
- • Regularly update and patch systems to address known vulnerabilities and reduce the risk of exploitation.
