Affected tools: Cursor, Codex, Gemini CLI, Antigravity — multiple CVEs issued (Source: BleepingComputer (July 2026); Google downgraded two Antigravity findings)
The Sandbox Was Intact. The Escape Worked Anyway.
Security researchers escaped the sandboxes in four AI coding tools — Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity — using a technique that did not require breaking the sandbox itself. Instead, they had the AI agent write files inside the sandbox that trusted host-side tools would later execute outside of it. The sandbox walls held. The escape route went around them.
How Write-Through Escapes Work
The attack pattern is elegant in its simplicity. An AI coding agent operates inside a sandbox — a restricted environment designed to limit what the agent can do. The agent cannot execute arbitrary commands on the host. But it can write files. If the sandbox's file system is shared with or synchronized to the host, and the host runs tools that automatically process files in that location — linters, build systems, shell configuration files, git hooks — then the agent can write a file that the host's own trusted tooling will execute.
The AI does not escape. It writes a payload. A tool the developer already trusts picks up that payload and runs it with host-level permissions. The sandbox is not breached. The trust boundary between the sandbox's file output and the host's tool input is the vulnerability.
AI Is a Risk Multiplier, Not Just a Productivity Tool
Every one of these AI coding tools was adopted because it makes developers more productive. Cursor autocompletes code. Codex generates implementations from prompts. Gemini CLI runs commands. The productivity gain comes from the same capability that creates the risk: the AI agent acts autonomously within its environment. When that environment has a write-through path to the host, autonomy becomes a liability.
This is the AI risk multiplier thesis in action. The AI agent does not need to be malicious. It does not need to be compromised. A prompt injection, a malicious repository, or a crafted code comment can direct the agent to write a specific file. The agent follows the instruction because generating files is its core function. The host-side tool executes the file because processing files is its core function. Every component does exactly what it was designed to do. The vulnerability is in the composition.
What Google's Response Reveals
Google downgraded two of the Antigravity findings — a decision that itself is a data point about how the industry is calibrating AI tool risk. The question of whether a sandbox escape via file write constitutes a vulnerability or a design limitation is not settled. The researchers say it is a vulnerability because untrusted code executes on the host. The vendor says the sandbox was not designed to defend against that path.
Both positions reveal the same underlying problem: the security model for AI coding tools has not caught up with how they are actually used. Developers run these tools in environments where file writes have consequences. Until the tooling either isolates file output completely or the host-side tools stop automatically executing files from shared paths, this class of escape will remain available.
The Web Infrastructure Angle
AI coding tools are now part of the web development pipeline. Developers use Cursor and Codex to generate the code that becomes the web applications WebPulse tracks. If a sandbox escape compromises the developer's machine, every application they deploy from that machine is potentially compromised — regardless of which framework it uses, regardless of its CVE count, regardless of its WebPulse score. The supply chain starts at the developer's workstation, and that workstation now has an AI agent with a write-through escape path.
