Four widely used AI coding agents, including Google's Antigravity, failed a coordinated security test that revealed a critical flaw in how they protect against malicious code injection. Rather than breaking out of their sandboxes directly, researchers found that these tools can write files that other unsandboxed programs later execute with full user privileges, effectively circumventing the security boundaries vendors built to contain them.

What Exactly Is the "Trust Handoff" Flaw?

Security researchers at Pillar Security spent a week in July 2026 testing sandbox escapes across four AI coding agents: Cursor, OpenAI's Codex CLI, Google's Gemini CLI, and Google's Antigravity. They discovered a pattern that none of the seven disclosed vulnerabilities actually broke the sandbox itself. Instead, each one exploited a gap between what the sandbox restricts and what a trusted component outside the sandbox later reads, runs, or scans.

The researchers described the problem this way: the agent "stays inside the box and follows every rule," but writes a file that some other, unsandboxed tool consumes after the agent's turn ends. That file might be a hook configuration, a virtual environment interpreter, a Git config entry, or a task definition. The sandbox polices what the agent does, but not what happens to the files the agent produces.

How Did Researchers Demonstrate These Vulnerabilities?

The research uncovered four recurring failure modes that allowed agents to bypass their security boundaries:

• Denylist Gaps: Denylist-based sandboxes, such as the macOS Seatbelt profile used by Antigravity, have failed to enumerate the full complexity of an operating system's attack surface, leaving specific primitives reachable that the denylist's authors did not anticipate.
• Trusted Configuration Files: Several agents treat project-local configuration files as trusted infrastructure rather than untrusted workspace content; a.claude/settings.local.json hook definition, a.vscode task file, and a Python virtual environment's interpreter binary can all be written by the agent inside the sandbox and then executed unsandboxed by a separate tool that assumes anything already present in the workspace was placed there deliberately by the user.
• Brittle Command Allowlists: Command allowlists that key off a command's name rather than its actual arguments proved fragile; Codex CLI's allowlist trusted git show as inherently read-only, without accounting for flags like --output that let the command write arbitrary file content.
• Privileged Daemon Access: Agents that can reach a privileged local daemon, most notably the Docker socket, inherit whatever authority that daemon has, regardless of how tightly the agent's own process is contained, since launching a container through the daemon sidesteps the agent sandbox entirely.

Cursor, made by Anysphere, was hit hardest by the findings. The IDE's workspace-controlled hook execution flaw, tracked as CVE-2026-48124 with a CVSS score of 8.5, was fixed in version 3.0.0. A second Cursor vulnerability involving a tampered Python virtual environment was patched in version 3.1.2. A third Cursor issue involving Git metadata indirection has not yet been assigned a CVE identifier, and patch status remains unclear.

OpenAI patched a related Codex CLI allowlist bypass, nicknamed "GitPwned," in version 0.95.0 and paid a bug bounty for it. However, Google took a different approach with its two Antigravity-specific findings. The company classified them as "other valid security vulnerabilities," downgraded their severity as difficult to exploit, and had not shipped fixes for either at the time of Pillar's disclosure. Google likewise declined to treat its own exposure in the shared Docker-socket finding as a vulnerability requiring a fix, a position OpenAI also took for Codex CLI's exposure to that same finding.

Why Should Developers Care About This Pattern?

This research suggests that current vendor threat models may not yet consistently account for the distinction between breaking a sandbox directly and manipulating what happens to an agent's output once it leaves the sandbox. The findings are particularly significant because they were discovered by unrelated research teams within months of each other, indicating that command-execution sandboxes for AI coding agents have accumulated multiple independent classes of escape.

Earlier in 2026, Cato Networks separately disclosed a different pair of Cursor sandbox flaws, CVE-2026-50548 and CVE-2026-50549, both rated 9.8 on the CVSS 3.1 scale and collectively named "DuneSlide." In those vulnerabilities, prompt-injected commands manipulated working-directory and symlink-validation logic to overwrite the sandbox helper itself and write outside the intended workspace boundary. Cursor initially rejected them as out of scope for its threat model before reopening and fixing them in version 3.0, with CVE numbers assigned in June.

Steps to Protect Yourself While Using AI Coding Agents

• Keep Your Tools Updated: Ensure you are running the latest versions of Cursor, Codex CLI, Gemini CLI, and Antigravity, as vendors have patched many of these vulnerabilities in recent updates.
• Review Agent-Generated Files: Manually inspect configuration files, virtual environment settings, and Git metadata that AI agents create, rather than assuming they are safe just because they exist in your workspace.
• Limit Daemon Access: Restrict your AI coding agent's access to privileged local services like the Docker socket, since agents can inherit the full authority of any daemon they can reach.
• Monitor for Suspicious Behavior: Watch for unexpected hook executions, interpreter changes, or Git configuration modifications that occur after your agent completes a task.

The research from Pillar Security, conducted by Eilon Cohen, Dan Lisichkin, and Ariel Fogel and published as a series of daily posts starting July 20, 2026, underscores a fundamental challenge in securing AI coding agents: sandboxes can only be as strong as the assumptions made by everything downstream of them. As AI agents become more autonomous and more widely deployed in development workflows, the security community will need to rethink how to protect users not just from agents breaking out of their boxes, but from agents writing files that other tools later execute with full privileges.