Your AI coding assistant can be tricked into running attacker code

The sandbox is not the problem

Security researchers found a pattern of vulnerabilities across every major AI coding agent on the market: Cursor, OpenAI Codex CLI, Gemini CLI, Claude Code, and Antigravity. Five different products from five different companies, all vulnerable to the same class of attack.

The interesting part is what the attacks do not do. They do not break through the sandbox directly. Instead, they exploit files the AI agent creates, which are then processed by trusted software running on the host machine outside any sandbox boundary.

How the attacks work

A malicious `.git` configuration file can trick AI coding agents into executing attacker-controlled code. The agent reads the repository, processes the config, and the host system treats the output as trusted because it came from a legitimate tool.

In Cursor specifically, a Claude hooks configuration could execute commands outside the sandbox entirely. That vulnerability, CVE-2026-48124, was patched in version 3.0.0. In OpenAI's Codex CLI, a safe command allowlist trusted command names without checking whether the arguments were dangerous. The command looked safe. The arguments were not.

Antigravity's vulnerability was similar in shape: the agent's output was treated as trusted input by the host system. The sandbox contained the AI. Nothing contained what the AI produced.

A new class of vulnerability

Traditional application security focuses on inputs: validate what comes in, sanitize it, reject anything suspicious. AI coding agents invert this. The dangerous content is the output, not the input. The AI writes a file, a config, or a script, and the host machine runs it because the file came from a tool the developer chose to trust.

Millions of developers now use AI coding assistants daily. The attack surface is not the AI model itself but the gap between what the AI produces and what the host system accepts without question.

What to check

Update Cursor to 3.0.0 or later. Check for updates to Codex CLI, Gemini CLI, and any other AI coding tools in your workflow. If you are running an older version of any of these tools, assume the sandbox escape vulnerabilities apply to you.

Beyond patching, treat AI-generated files the same way you would treat files from an untrusted source. Review `.git` configs, hook scripts, and any configuration files your AI agent creates before your build system processes them. The AI wrote them. That does not make them safe.

The part worth watching: these are the vulnerabilities researchers found by looking. AI coding agents are months old in their current form. The gap between what the sandbox contains and what the host trusts is a structural problem, not a one-off bug. Expect more disclosures in this category.