Researchers found sandbox escapes or boundary bypasses in Cursor, Codex, Gemini CLI, and Antigravity by writing files that trusted tools use; most are patched
Security researchers broke out of the sandboxes in four widely used AI coding agents, including Cursor, OpenAI's Codex …
Context & Ripple Effects
AI-agent security coverage has moved from attempts to bypass model guardrails—such as many-shot jailbreaking—to weaknesses created when agents act inside developer environments. The relevant boundary is no longer only what a model will say, but what its surrounding tools will trust and execute.
The report also extends a known Antigravity risk: an indirect prompt-injection path through a browser subagent showed how agent workflows can be manipulated through their integrations. Codex's recent native sandboxing on Windows makes the implementation of those boundaries especially consequential.
First-order effects
- Cursor, Codex, Gemini CLI, and Antigravity users need to apply available fixes and reassess projects or workspaces where agent-created files can be consumed by trusted tools.
- The affected vendors must treat file handoffs and downstream tool configuration as part of the sandbox boundary, not merely rely on isolation around the agent process.
Second-order effects
- Enterprise teams adopting coding agents will place more scrutiny on filesystem permissions, tool configuration, and the trust relationship between agent outputs and developer tooling.
- Competing coding-agent providers are pushed to demonstrate that their sandboxes account for cross-tool workflows, since a boundary bypass can negate otherwise strong isolation.
Third-order effects
- If this pattern persists, AI coding-agent security will be judged increasingly by end-to-end workflow containment rather than model-level safeguards alone.
- The industry may shift toward more explicit controls over what agents can write and which trusted tools may later consume those artifacts, reducing the practical blast radius of compromised workflows.
The trend: AI-agent security is shifting from prompt and model defenses toward controlling the permissions, artifacts, and tool chains through which agents take action.