AI coding assistants get tricked into hacking their own developers

Key points

• Pillar Security published seven sandbox escapes on 25 November 2025 affecting four AI coding assistants: Cursor, OpenAI's Codex CLI, Google's Gemini CLI and Google's Antigravity.
• The attacks do not break the safety box directly; the AI writes an innocent-looking file that a trusted program outside the box later runs.
• Cursor fixed one flaw as CVE-2026-48124 in version 3.0.0, and OpenAI patched Codex CLI in v0.95.0 with a high-severity bounty paid.
• Google classed the two Antigravity findings as lower severity, arguing they need a developer to trust a booby-trapped project.
• A shared flaw in how the assistants talk to Docker's local helper hit Cursor, Codex and Gemini CLI at the same time, and is now fixed.

AI coding assistants are meant to run inside a safety box, called a sandbox, that stops them touching the rest of your computer.

Researchers at Pillar Security have shown that the box does not have to be broken for the attack to work. The assistant follows every rule. It just writes a file. Something else on the machine, sitting outside the box, then reads that file and does what it says.

Adam Bushal here. This is the class of bug I have been waiting to see land, and it landed hard.

How does the trick actually work?

A developer's editor is not one program, it is many. There is a Python helper picking which version of Python to use. There is a Git helper watching for file changes. There are task files that the editor runs when you open a project. Docker Desktop, the tool for running app containers, listens on a local channel any program can talk to.

All of that lives outside the AI's sandbox, and all of it trusts files inside the project folder.

So the hackers plant a poisoned instruction somewhere the AI will read it: a project README, a bug report, a code change, a downloaded dependency. The AI, doing its job, follows the instruction and edits a config file. Minutes later, a trusted helper opens that config and runs the command hidden inside. The sandbox was never touched.

This is called indirect prompt injection, where hidden instructions in text the AI reads become real actions on your machine.

Which tools were hit and are they fixed?

Pillar's team, Eilon Cohen, Dan Lisichkin and Ariel Fogel, spent months reproducing the bugs and are releasing one a day. The write-up was first reported by BleepingComputer.

In Cursor, a config file called .claude could be rewritten to run any command outside the sandbox. That is now CVE-2026-48124 and fixed in Cursor 3.0.0. A second Cursor bug let the AI swap out the Python interpreter the editor later ran on its own. A third abused Git's ability to store its bookkeeping in a folder that is not called .git, sliding past Cursor's rules about which paths are dangerous.

In OpenAI's Codex CLI, the safe-command list trusted git show by name, without checking what arguments were being passed. The real command was not read-only at all. OpenAI patched it in v0.95.0 and paid a high-severity bounty.

One finding hit three products at once. Cursor, Codex and Gemini CLI could all reach the Docker Desktop local channel, which runs with high privileges and sits well outside any AI sandbox. Fixed.

Google's response on its Antigravity tool was cooler. Both findings, one bypassing macOS Seatbelt and one abusing .vscode task files to escape Secure Mode, were logged as lower severity. Google's reasoning: a developer has to open a dodgy repository first. In practice, developers open dodgy repositories all day.

What should developers actually do?

Update Cursor to 3.0.0 or later. Update Codex CLI to v0.95.0 or later. Treat any AI-assisted project pulled from the internet the way you would treat a stranger's USB stick.

The failure mode here is not the sandbox. It is every trusted tool sitting next to the sandbox, reading files the AI is allowed to write.

One thing the post-mortem will say: agentic coding tools shipped before the ecosystem around them was ready.