What happened
Pillar Security published (July 20-21, 2026) a week-long disclosure series detailing 7 vulnerabilities across 4 major AI coding agents showing agents can indirectly cross sandbox boundaries — not by breaking the sandbox, but by writing files (Docker sockets, git configs, VS Code tasks, Python venvs) that trusted host components later execute. Cursor and OpenAI shipped fixes (incl. CVE-2026-48124); Google downgraded its two Antigravity findings as low-severity/unpatched.
Why it matters
Challenges the fundamental assumption that agentic-IDE sandboxes provide real isolation, showing a repeatable class of trust-boundary bypass that affects nearly every major AI coding agent — with direct implications for enterprises running these tools on developer machines with corporate access.
Applicability
AppSec and platform-security teams supporting Cursor/Codex/Gemini CLI/Antigravity should treat agent file-writes as untrusted code execution and review host-side automation (git hooks, Docker sockets, IDE tasks) immediately.