{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-48124",
    "name": "CVE-2026-48124",
    "vendor": "Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out",
    "description": "Pillar Security published a week-long series demonstrating working sandbox escapes in four AI coding agents in a row, then a follow-up when OpenAI supplied an eighth real-world example. The common thread is that each vendor ships a sandbox as the safety story for autonomous execution, and in each case the boundary could be crossed from inside by the agent itself. Tracked as CVE-2026-48124 with two GitHub advisories (GHSA-v4xv-rqh3-w9mc, GHSA-p9g2-cr55-cw9c).",
    "website": "https://www.pillar.security/blog/the-week-of-sandbox-escapes",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-07-20",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-48124",
      "aliases": [
        "ti-061",
        "GHSA-v4xv-rqh3-w9mc"
      ],
      "title": "The Week of Sandbox Escapes: Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out",
      "summary": "Pillar Security published a week-long series demonstrating working sandbox escapes in four AI coding agents in a row, then a follow-up when OpenAI supplied an eighth real-world example. The common thread is that each vendor ships a sandbox as the safety story for autonomous execution, and in each case the boundary could be crossed from inside by the agent itself. Tracked as CVE-2026-48124 with two GitHub advisories (GHSA-v4xv-rqh3-w9mc, GHSA-p9g2-cr55-cw9c).",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Sandbox escape"
      ],
      "componentType": "agent",
      "component": {
        "name": "Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/antigravity"
      },
      "affected": [
        {
          "range": null,
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-20",
      "modifiedAt": "2026-07-20",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.pillar.security/blog/the-week-of-sandbox-escapes"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48124"
        },
        {
          "type": "advisory",
          "url": "https://github.com/advisories/GHSA-v4xv-rqh3-w9mc"
        }
      ],
      "mitigation": "Update all four agents to current versions. Treat a vendor sandbox as defense in depth, not a boundary you can grant autonomy behind: keep credentials out of reach of the agent user, and require approval for shell execution even where a sandbox is enabled.",
      "detectedByAnomity": true
    }
  }
}