Affected Systems
Multiple AI development tools: Cursor IDE, OpenAI Codex, Google Gemini CLI, and Antigravity. Vulnerability affects AI agent sandbox implementations where agents write files executed by host tools, enabling sandbox escape.
Exploitation Status
Research disclosure; exploitation demonstrated by researchers. No CVE assigned yet. Active exploitation in the wild unknown.
Business Impact
AI coding assistants can escape sandbox restrictions and execute arbitrary code on developer workstations. Attackers could exploit this via prompt injection or malicious code suggestions to compromise developer environments, access credentials, source code, or pivot to internal networks. Particularly critical for organizations using AI-assisted development tools in production environments.
Urgency
🟠Within 24 hours
Recommended Actions
- Audit all AI development tools (Cursor, Codex, Gemini CLI, Antigravity) for automatic file execution behavior and disable or restrict until patches available
- Implement strict file execution policies preventing AI agents from writing to executable paths or triggering host tool execution chains
- Monitor developer workstations for unexpected file writes to config directories, shell profiles, or executable paths by AI tool processes
- Review and restrict AI agent permissions to minimum necessary; isolate AI tool network access from sensitive internal resources
- Educate developers on prompt injection risks and establish code review requirements for AI-generated code before execution