AI Coding Tools Sandbox Escapes: Mitigating Cursor, Gemini CLI, and Antigravity Vulnerabilities

Recent research has uncovered critical sandbox escape vulnerabilities in several popular AI-powered coding assistants and development environments, including Cursor, Codex, Gemini CLI, and Antigravity. By manipulating the "tool use" functionality of these agents, researchers demonstrated that the AI can write malicious files to disk which are subsequently executed by trusted host tools. This effectively breaks the isolation boundary between the AI agent and the underlying operating system, allowing an attacker to pivot from an AI prompt to local code execution on the developer's machine.

For defenders and engineering teams, this represents a significant shift in the threat landscape. The AI assistant, often treated as a trusted helper, becomes a potential vector for supply-chain style attacks. While Google has downgraded the severity of two findings related to Antigravity, the underlying technique—utilizing the agent's file-writing capabilities to subvert host tool execution—remains a viable attack path across multiple platforms.

Technical Analysis

Affected Products:

• Cursor (IDE/Editor)
• OpenAI Codex
• Google Gemini CLI
• Antigravity (Development Environment)

Vulnerability Mechanics: The core issue stems from the "tool use" or "function calling" architecture inherent in modern AI agents. These agents are designed to assist with coding tasks by writing files to the project directory and invoking local tools (like linters, build systems, or test runners) to validate the code.

The attack chain is as follows:

1. Prompt Injection/Jailbreak: An adversary provides a malicious prompt to the AI agent (potentially via a poisoned repository or direct input).
2. File Creation: The agent, following its instructions, writes a payload file (e.g., a malicious script or configuration file) to the disk.
3. Host Tool Invocation: The agent calls a trusted host tool to process the file (e.g., npm install, python script.py, or a specific linter).
4. Sandbox Escape: Because the host tool trusts the files in the workspace, it executes the malicious code with the permissions of the user running the AI tool. The sandbox designed to contain the AI model fails to restrict the execution of the host tool.

Exploitation Status: Proof-of-concept (PoC) code has been demonstrated showing full local code execution. Vendors have released patches, but the wide adoption of these tools means many environments remain vulnerable if updates are not applied promptly.

Detection & Response

Detecting these attacks requires monitoring for anomalies in the process lineage of AI development tools. Specifically, defenders should look for the AI application spawning unexpected shell processes or interpreters that facilitate the execution chain described above.

Sigma Rules

---
title: Potential AI Coding Tool Sandbox Escape
id: 8f9c2a1d-5e6b-4a3c-9d8e-1f2a3b4c5d6e
status: experimental
description: Detects AI development tools (Cursor, Gemini CLI) spawning shells or interpreters, which may indicate a sandbox escape via tool invocation.
references:
  - https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1204
logsource:
  category: process_creation
  product: linux # Adjust for macos/windows as needed
detection:
  selection_parent:
    ParentImage|contains:
      - 'cursor'
      - 'gemini'
      - 'antigravity'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python'
      - '/node'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate developer use of AI tools to run build scripts or test environments.
level: high
---
title: AI Tool Writing Suspicious File Extensions
id: 3d4e5f6a-7b8c-9d0e-1f2a-3b4c5d6e7f8a
status: experimental
description: Detects AI agent processes creating files with suspicious extensions (e.g., .sh, .py, .ps1) in user directories, indicative of payload staging.
references:
  - https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1204
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|contains:
      - 'cursor'
      - 'gemini'
    TargetFilename|endswith:
      - '.sh'
      - '.py'
      - '.js'
  condition: selection
falsepositives:
  - Normal coding activity where AI generates valid script files.
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for AI tools spawning unauthorized shells or interpreters
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("cursor", "gemini", "antigravity")
| where FileName in~ ("bash", "sh", "zsh", "python", "python3", "node", "powershell", "pwsh")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessId
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for suspicious child processes spawned by AI development tools
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ "cursor" 
   OR Parent.Name =~ "gemini"
   OR Parent.Name =~ "antigravity"
-- Filter for common shell interpreters that might be used for execution
AND Name =~ "(bash|sh|zsh|python|node|perl)"


**Remediation Script (Bash)**

#!/bin/bash
# Remediation script to check for running instances and prompt for update

echo "Checking for running AI development tool processes..."

TOOLS=("cursor" "gemini" "antigravity")
FOUND=0

for TOOL in "${TOOLS[@]}"; do
    if pgrep -x "$TOOL" > /dev/null; then
        echo "[!] $TOOL is currently running. Consider terminating it before applying patches."
        pgrep -l "$TOOL"
        FOUND=1
    fi
done

if [ $FOUND -eq 0 ]; then
    echo "[*] No target AI tools currently detected as running."
fi

echo ""
echo "[*] Action Required:"
echo "    1. Verify you are running the latest version of Cursor, Gemini CLI, and Antigravity."
echo "    2. Review vendor changelogs for sandbox mitigation patches (released April 2026)."
echo "    3. Restrict write permissions for AI agents to isolated directories only."

Remediation

1. Patch Immediately: Apply the latest security patches released by the vendors for Cursor, Google Gemini CLI, and Antigravity. These patches address the logic flaws allowing the AI to invoke host tools on untrusted files.
2. Isolate Workspaces: Configure AI coding assistants to operate within strictly isolated directories or containers (e.g., Docker, Firejail) with no access to sensitive system paths or credentials.
3. Review Tool Permissions: Audit the permissions granted to the AI agent. Disable auto-confirmation features for tool execution (e.g., "Auto-run commands") to require human verification before any host tool executes a file written by the AI.
4. Vendor Advisory Review: While Google has downgraded two Antigravity findings, treat all reported sandbox escapes as high-priority. The capability for local code execution poses a severe risk to developer workstations and build environments.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub