Sandbox escapes hit Cursor, Codex, Gemini CLI — patch now
Pillar Security showed agents can plant files your host later runs; Cursor 3.0.0 and Codex 0.95.0 patch it, Google won't fix Antigravity. Plus Dorsey's Buzz.
Copy markdown
The workspace is the exploit, not the agent
Pillar Security's "Week of Sandbox Escapes" showed the agent never breaks out — it writes files (.vscode tasks, .claude hooks, a swapped virtualenv interpreter) or reaches the Docker socket, and unsandboxed host tools run them later. A poisoned repo or a single prompt injection is enough to land code execution on your machine, because the blast radius is everything the agent can write that the host then trusts.
Update Cursor to 3.0.0 and Codex CLI to 0.95.0
Cursor fixed three issues in v3.0.0, including CVE-2026-48124 for workspace-controlled .claude hooks plus virtualenv and git-metadata bypasses; Codex CLI patched a git-allowlist bypass in v0.95.0 (OpenAI paid a high-severity bounty), and the shared Docker-socket escape is fixed across Codex, Cursor, and Gemini CLI. If you run any of these agents, upgrade before your next untrusted repo.
Google won't patch Antigravity
Google downgraded both Antigravity findings — an allow-by-default macOS Seatbelt profile and a VSCode-task "time bomb" — to "other valid vulnerabilities" and declined to fix them as hard to exploit, even though CyberScoop reports one chain reaches remote code execution. Until that changes, keep agent-generated config out of your build path and treat anything Antigravity writes as untrusted.
Dorsey's Buzz: a Slack for you and your agents
Block shipped Buzz on July 21 — a free, open-source (GitHub), Nostr-based desktop app for macOS, Windows, and Linux that puts humans and AI agents in the same chat, gives each agent its own cryptographic identity, and bundles Git hosting. It's model-agnostic and self-hostable, so you can wire your own agents in as first-class, addressable teammates rather than bolt-on bots.