Programming agents in Cursor, Codex, Gemini CLI, and Antigravity can indirectly escape their sandboxes through a novel attack vector. Rather than breaking isolation directly, these models create or modify files within projects that are later interpreted or executed by trusted tools operating outside the sandbox environment—effectively bypassing security restrictions without needing to compromise the sandbox itself.
In simulated attacks, researchers demonstrated how this indirect escape works: malicious code injected into project files gets executed when legitimate development tools process those files after the model's execution ends. This turns the trust relationship between isolated agents and external tools into a vulnerability.
The Cursor team addressed the issue in version 3.0.0, and Codex fixed it in version 0.95.0. Google's response differs slightly—the company determined that vulnerabilities in its models require either social engineering or user trust in a malicious repository, suggesting a different risk profile. The full technical details of these vulnerabilities and their fixes are available on TabNews and BleepingComputer.
