Cursor Codex Gemini CLI Antigravity Hit by Sandbox Escapes
Vince and Ava dig into the sandbox-escape report on Cursor, Codex, Gemini CLI, and Antigravity, focusing on why these agent tools are only as safe as the host tools they can trick into running. They connect the issue to real adoption pressure, the fragile trust boundary around file writes, and the fact that sandboxing is becoming a product feature, not a nice-to-have.
Transcript
Vince Okay, this one feels very now. If you’re asking a tool to write files for you and then the rest of your stack trusts those files, that’s not a tiny bug. That’s the whole product boundary getting weird.
Ava Right. The report’s basically saying researchers escaped the sandbox in Cursor, Codex, Gemini CLI, and Antigravity by getting the agent to write files that host tools later ran. So the failure isn’t some sci-fi model jailbreak. It’s ordinary workflow trust, which is worse in a way.
Vince Yeah, because that’s the part people actually ship. Nobody buys the demo because they want a sandbox diagram. They buy it because the agent can touch files, move faster, and cut out ten annoying steps.
Ava Exactly. And once the host side starts treating generated output like local code, the sandbox is only as strong as the next tool in the chain. That’s a very boring sentence, but it’s the whole story.
Vince How are you doing, by the way? You looked like you were about to argue with a folder structure.
Ava I’m fine. Slightly offended on behalf of every tool that thought a text file was harmless. Also, this is such an Exploring Next problem. We spend half our lives pretending the edges are clean.
Vince Ha! Yeah, and then reality shows up with a wrench. I do think the user story is still real, though. People want the agent to draft, edit, and hand off work without babysitting every click.
Ava Mm-hm. The catch is that “hand off” is exactly where the attack surface lives. If a trusted host command later consumes what the agent wrote, you need a much tighter policy than just “the model is in a sandbox.”
Vince And that’s the product pain. If the fix makes the tool too fussy, people bounce. If it stays loose, you get a nice demo and a security incident. Delightful little range of options there.
Ava No way. That’s the whole trade-off. The clever part is that these systems are useful precisely because they cross boundaries. The questionable part is that the boundary crossing is where you’d like some actual discipline.
Vince Okay, zooming out for a second, this is the same weird race as Cursor, Codex, Gemini CLI, and Antigravity all trying to own the agent layer at once. And meanwhile the boring safety layer is still catching up, which is extremely on brand for twenty twenty-six.
Ava Yeah, and it’s not abstract. The category is moving fast enough that sandboxing is becoming a differentiator, not a footnote. If you can’t explain the trust chain, you don’t really have an agent product yet.
Vince Which is exactly why this matters to actual users, not just security people. If the tool can’t survive the first real workflow, the adoption path gets ugly fast.
Ava Mm-hm. And I like the tools, annoyingly. I just don’t like pretending the file system is a harmless little side quest.
Vince That is such an Ava sentence. Also, rude to the file system, honestly.
Ava It earned it.
Vince Fair. Okay, I’m going to stop you before you invent a second sandbox just out of spite. Good episode, Ava.