Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes

Pillar Security researchers disclosed a class of "configuration-based sandbox escape" flaws across several AI coding agents (Cursor, Codex CLI, Gemini CLI, Antigravity) in which an agent, while remaining sandboxed, writes files that trusted local tools later execute—resulting in host code execution. Multiple issues were reproduced, tracked with CVEs (for example CVE-2026-48124) and mostly patched, though some vendors assessed certain findings as harder to exploit; the work exposes a systemic cross-vendor weakness in how local tooling trusts repository/workspace files.