Skip to content
Codex, Claude Code, Cursor and Docker sandbox escapes: the four fix versions to check this week, and what OpenAI's statement leaves out
Back to Blog
#Codex sandbox escape#Claude Code 2.1.247#Cursor CLI#Docker CVE-2026-77179#coding agent security#core.fsmonitor

Codex, Claude Code, Cursor and Docker sandbox escapes: the four fix versions to check this week, and what OpenAI's statement leaves out

Amir Khan

Eight days. That is how long OpenAI took to close two holes in the Codex sandbox after Accomplish AI reported them on 12 August, and it is the number OpenAI's statement to BleepingComputer on 21 September is built to make you remember. Read the statement again for what it leaves out. It does not name a version. It does not say whether the tool that opened the second hole is still switched on by default. It does not say whether anyone was hit.

The version numbers come from the researcher, not the vendor. Here they are, with the other escapes the same researcher published in the same fortnight. A Pakistani software house is running at least one of these on a laptop that also holds a client's SSH keys.

AgentEscapeReportedFixed inWriteup
Claude Code (macOS)Beltdown, via core.fsmonitor13 July2.1.223 partial (6 Aug); 2.1.247 full (26 Aug)11 Sept
Cursor CLI (macOS)Beltdown2, same classnot dated in the post2026.08.04-aaa880912 Sept
Codex CLIOverpatch, via apply_patch12 Aug0.149.015 Sept
Codex Desktop (macOS)Heapjack, via node_repl12 Augbuild 26.818.2164115 Sept
Docker Desktop / Sandboxes (macOS, Docker VMM on)CVE-2026-77179, virtio-fsnot dated in the post4.88.0 / 0.42.019 Sept

Dates and versions as printed by Accomplish AI and BleepingComputer; the vendors have confirmed the fixes but published no advisories of their own that I could find.

Video title card listing Cursor, Codex CLI, Gemini CLI and Antigravity as sandbox-escaped, with a presenter pointing at it
The July set, not the September one: Pillar Security's four (Cursor, Codex CLI, Gemini CLI, Antigravity), which BleepingComputer cites as the same class of bug. From 4 AI Coding Agents Escaped Their Sandboxes. Google Didn't Patch One by Skill MD.

What the four have in common

Every one starts the same way: you clone somebody else's repository and open it in the agent. No prompt. Nothing on screen. In three of the four cases the agent never ran a shell command at all.

Two of them are a git setting. A repository's own .git/config can name a program under core.fsmonitor, and git runs it whenever it looks at the working tree. Claude Code and Cursor both ran their own housekeeping git commands outside the sandbox that wrapped the agent's shell, so the repository's program ran outside it too. Anthropic's fix blanks the setting on every git call the harness makes. Cursor's fix is four environment variables on every git spawn, and Accomplish calls it the right approach because there is no call site left to forget:

GIT_CONFIG_COUNT=4
GIT_CONFIG_KEY_0=safe.bareRepository   GIT_CONFIG_VALUE_0=explicit
GIT_CONFIG_KEY_1=core.fsmonitor        GIT_CONFIG_VALUE_1=false
GIT_CONFIG_KEY_2=core.hooksPath        GIT_CONFIG_VALUE_2=/dev/null
GIT_CONFIG_KEY_3=core.attributesFile   GIT_CONFIG_VALUE_3=/dev/null

Those four lines are the one thing in this story a shop can copy today, into any CI job that runs git against code it did not write.

The Codex pair are different mechanisms with the same shape. Overpatch: the patch tool worked out its own write permissions from the paths in the patch, so a line naming /tmp widened the grant to the whole disk. Heapjack: the JavaScript tool Codex Desktop installs keeps trusted and untrusted code in one Node process, and the secret that tells them apart was a string in the shared heap; the untrusted side snapshotted the heap and read it. Accomplish's line for both, quoted by BleepingComputer:

"The thing doing the enforcement was sitting inside the thing being enforced."

Title card for a short security video about four coding agents escaping their sandbox
From 4 AI Coding Agents Escaped Their Sandbox Without Breaking It by Krypteia Security, 16 September.

Heapjack ran in read-only mode, the strictest Codex has. The tool that opened it, node_repl, is written into ~/.codex/config.toml at install with no opt-in and, at the time of the writeup, no setting to turn it off. OpenAI's statement says the issue was addressed. It does not say the default changed.

What a Pakistani software house does with this before Friday

The 21 September post said a prompt is not a network boundary. This is the same lesson one layer down. The sandbox is not a boundary either while the thing enforcing it runs inside it. The difference is that this time every item has a version number, and the check takes ten minutes:

  1. claude --version at or above 2.1.247. codex --version at or above 0.149.0. Codex Desktop build 26.818.21641 or later. Cursor CLI 2026.08.04 or later. Docker Desktop 4.88.0 if Docker VMM is on in Settings, and it will be on for everyone at the end of October when it becomes the default.
  2. A client's repository, a contractor's repository, a repository from a job board: opened in a throwaway VM or a container with no Docker socket mounted, on a machine that holds no production credentials. Read-only mode is not a substitute. Heapjack ran in read-only mode.
  3. The four GIT_CONFIG lines above into every CI job that clones third-party code.
  4. The 18 September egress rule still applies inside the VM: placeholder credentials in the guest, a proxy on the host the agent cannot reach.
Thumbnail of a video on running Claude Code inside a Docker sandbox
Running the agent inside a container is the cheap version of the fix; CVE-2026-77179 is the reminder that the container has a floor too. From I Let Claude Code Run Wild. Docker Sandbox Controlled What It Could Access by Shark Numbers.

One caveat the press skipped. Accomplish sells a VM-isolated agent runner, and each post ends by saying so. The findings are vendor-confirmed; the framing is a vendor's. Three of the four escapes are macOS-specific; Overpatch is in the open-source Codex CLI and runs anywhere.

Title card for a video on a week of AI agent sandbox escapes
From The Week of Sandbox Escapes: How AI Tricks Host Tools into Self-Attacks by SCIENCE CONSCIOUSNESS.

Disclosure is the other datum. OpenAI fixed in eight days and said so. Anthropic took 44 days and two releases. Cursor shipped the fix and said nothing public. Docker assigned a CVE. None of the four told customers which version to check before a researcher's blog did.

Title card reading The agent sandbox is not a sandbox
From The agent sandbox is not a sandbox by Inference Wire.

My read, and it is a prediction rather than a fact: one researcher has published one escape a week for four weeks, and the class of bug (enforcement inside the enforced) is a design habit, not a typo. I expect a fifth harness's fix version to be published by Accomplish or a comparable lab before 31 October, and I expect it to be a git-spawn or a shared-process bug again. If nothing lands by then, the class was shallower than it looks and the four fixes above were the end of it.

Until then, the rule for the policy document is one sentence. A cloned repository is a program you run.

Sources