# CVE-2026-48124: The Week of Sandbox Escapes: Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out

> CVE-2026-48124 is a critical-severity remote code execution issue in Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out, an AI agent.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-48124
- **Aliases:** ti-061, GHSA-v4xv-rqh3-w9mc
- **Severity:** critical
- **Attack type:** Remote code execution, Sandbox escape
- **Component:** Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out (AI agent)
- **Catalog entry:** https://catalog.anomity.ai/agent/antigravity
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-07-20
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-48124

## Summary

Pillar Security published a week-long series demonstrating working sandbox escapes in four AI coding agents in a row, then a follow-up when OpenAI supplied an eighth real-world example. The common thread is that each vendor ships a sandbox as the safety story for autonomous execution, and in each case the boundary could be crossed from inside by the agent itself. Tracked as CVE-2026-48124 with two GitHub advisories (GHSA-v4xv-rqh3-w9mc, GHSA-p9g2-cr55-cw9c).

## Affected versions

| Affected | Fixed in |
| --- | --- |
| see advisory | no fixed version listed |

## Am I affected by CVE-2026-48124?

You are affected if Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out is installed or configured on a machine. Check the references for the exact versions.

## How do I fix CVE-2026-48124?

Update all four agents to current versions. Treat a vendor sandbox as defense in depth, not a boundary you can grant autonomy behind: keep credentials out of reach of the agent user, and require approval for shell execution even where a sandbox is enabled.

## How do I find every machine running Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out and which version, then enforce a policy on it.

## References

- article: https://www.pillar.security/blog/the-week-of-sandbox-escapes
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-48124
- advisory: https://github.com/advisories/GHSA-v4xv-rqh3-w9mc

## Related vulnerabilities

- [openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and](https://catalog.anomity.ai/vuln/openai-codex-two-sandbox-escapes-apply-patch-overpatch-in-codex-cli-and) — high
- [CVE-2026-82533](https://catalog.anomity.ai/vuln/cve-2026-82533) — critical
- [CVE-2025-68668](https://catalog.anomity.ai/vuln/cve-2025-68668) — critical
- [ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf](https://catalog.anomity.ai/vuln/ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf) — high
- [google-patches-antigravity-ide-prompt-injection-sandbox-escape](https://catalog.anomity.ai/vuln/google-patches-antigravity-ide-prompt-injection-sandbox-escape) — high
- [CVE-2026-115726](https://catalog.anomity.ai/vuln/cve-2026-115726) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-48124