Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes

Security reporting from **BleepingComputer** detailed sandbox escapes affecting **Cursor**, **Codex**, **Gemini CLI**, and **Antigravity**. Researchers demonstrated that AI agents could be manipulated into writing files that trusted host tools later run, prompting **multiple CVEs**, official patches, and **Google** downgrading two Antigravity findings.

The attack vector hinges on specific product mechanics between agent outputs and host system operations. Under this design, the AI agent writes files to disk which are subsequently executed by trusted host tools, effectively breaking out of the sandbox without directly overriding host execution controls.

For engineers and system builders, these findings expose a structural weakness in AI agent isolation models. Security boundaries fail when host environments grant implicit trust to host tools executing agent-generated files, turning routine file generation into an indirect local code execution path.

In the broader market context, the vulnerability impacts several leading AI coding tools concurrently. While affected vendors issued security patches and registered CVEs, **Google** chose to downgrade two findings associated with **Antigravity**, reflecting differing vendor assessments of threat severity.

Engineers deploying autonomous developer agents must restrict background execution permissions for host tools interacting with agent-generated files. Security teams should monitor vendor patch advisories, updated CVE classifications, and ongoing host-tool permission model updates across their development environments.