Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
Summary
Researchers have discovered sandbox escape vulnerabilities in several AI tools, including Cursor, Codex, Gemini CLI, and Antigravity. These vulnerabilities were exploited by having AI agents write files that were then executed by trusted host tools. This led to multiple CVEs being issued, with patches released and Google downgrading two findings related to Antigravity.
IFF Assessment
Sandbox escapes allow malicious actors to gain unauthorized access and potentially execute arbitrary code, posing a significant threat to systems and data.
Severity
The high CVSS score is estimated due to the potential for unauthorized code execution (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attack vector is network-based, the complexity is low, no privileges are required, user interaction is required to trigger the exploit, the scope is unchanged, and the impact on confidentiality, integrity, and availability is high.
Defender Context
This highlights the ongoing challenge of securing AI environments, as attackers can leverage the trust placed in host tools to bypass sandbox protections. Defenders should monitor for new vulnerabilities in AI platforms and ensure that any AI-generated code or files are rigorously validated before execution.