The Week of Sandbox Escapes Day 1: Escaping Antigravity's Allow-Default Seatbelt

This report analyzes a macOS sandbox escape used by AI coding agents that arises from vendors using allow-default seatbelt profiles: an attacker mounts a devfs volume (which lacks extended attributes), builds a .app bundle with an LSEnvironment BASH_ENV pointing to a payload, symlinks /bin/bash as the bundle executable, and uses Launch Services (open) to spawn a bash process outside the sandbox. The post includes a step-by-step proof of concept, references CVE-2023-32364 and explains why Apple's patches do not block this chain under an allowlist-denylist inversion, notes required preconditions (Secure Mode off, terminal sandbox on, auto-execute set to "Always Proceed"), and recommends using (deny default) profiles to properly confine agents.