AI coding assistants get tricked into hacking their own developers

Key points

• Pillar Security published seven sandbox escapes affecting four AI coding assistants: Cursor, OpenAI's Codex CLI, Google's Gemini CLI and Antigravity.
• The attacks don't break the safety box directly; the AI writes an innocent-looking file that a trusted program outside the box later runs.
• Cursor fixed one flaw as CVE-2026-48124 in version 3.0.0, and OpenAI patched Codex CLI in v0.95.0 with a high-severity bounty paid.
• Google classed both Antigravity findings as lower severity, arguing they need a developer to trust a booby-trapped project.
• A shared flaw in how the assistants talk to Docker's local helper hit all three non-Google tools at once, and it's now fixed.

AI coding assistants are meant to run inside a safety box, called a sandbox, that stops them touching the rest of your computer. Pillar Security's researchers have shown that the box doesn't have to be broken for the attack to work. The assistant follows every rule. It just writes a file. Something else on the machine, sitting outside the box, reads that file and does what it says.

This is the class of bug I've been waiting to see land, and it landed hard.

How does the trick actually work?

A developer's editor isn't one program, it's many. A Python extension picks which interpreter to use. Git watches for file changes. VS Code runs task files when you open a project. Docker Desktop listens on a local socket any program can reach. All of that lives outside the AI's sandbox, and all of it trusts files inside the project folder.

So the attacker plants a poisoned instruction somewhere the AI will read it: a project README, a bug report, a downloaded dependency. The AI, doing its job, edits a config file. Minutes later, a trusted helper opens that config and executes the command hidden inside. The sandbox was never touched.

This is called indirect prompt injection, where hidden instructions in text the AI reads become real actions on your machine. Cymulate documented the same pattern in April, calling it "Configuration-Based Sandbox Escape," across Claude Code, Gemini CLI and Codex CLI.

Which tools were hit and are they fixed?

Pillar's team, Eilon Cohen, Ariel Fogel and Dan Lisichkin, spent months on these and are releasing one write-up a day. BleepingComputer first reported the series.

In Cursor, a config file called .claude could be rewritten to run any command outside the sandbox. That's now CVE-2026-48124, fixed in Cursor 3.0.0. A second Cursor bug let the AI swap out the Python interpreter the editor's own extension later ran. A third abused Git's ability to store its bookkeeping in a folder that isn't called .git, sliding past Cursor's path-based rules. We've been tracking Cursor's sandbox problems since two 9.8-rated flaws surfaced in early July, so this isn't a new pattern for that codebase.

In OpenAI's Codex CLI, the safe-command list trusted git show by name without checking the arguments being passed. The real invocation wasn't read-only at all. OpenAI patched it in v0.95.0 and paid a high-severity bounty.

One finding hit Cursor, Codex and Gemini CLI simultaneously. All three could reach the Docker Desktop local socket, which runs with high privileges and sits well outside any AI sandbox. It's fixed.

Google's response on Antigravity was cooler. Both findings, one bypassing macOS Seatbelt and one abusing .vscode task files to escape Secure Mode, were logged as lower severity. Google's reasoning: a developer has to open a dodgy repository first. In practice, developers open dodgy repositories all day.

What should developers actually do?

Update Cursor to 3.0.0 or later, and Codex CLI to v0.95.0. Treat any AI-assisted project pulled from the internet the way you'd treat a stranger's USB stick.

The failure mode isn't the sandbox itself. It's every trusted tool sitting next to the sandbox, reading files the AI is allowed to write. The breadth here is the real signal: the same failure appears across four tools from three vendors, which tells you this is an ecosystem problem, not a single vendor's bad day. Agentic coding tools shipped before the ecosystem around them was ready for the threat model they created.