Startup Finds Leaky Sandboxes in Claude Code, OpenAI Codex, and Cursor

Stealth startup Accomplish disclosed leaky sandbox vulnerabilities across Claude Code, OpenAI Codex, and Cursor after quietly flagging them to each vendor over the summer. Cursor and OpenAI shipped fixes in about a week; Anthropic took roughly 50 days and 30 releases before patching.

The issue isn't a classic sandbox escape — the coding agents themselves stay contained. Instead, the attacks exploit files the AI agent creates inside a project, which are later read and trusted by other software on the host machine. In Cursor specifically, a configuration file for Claude hooks could be abused to execute commands outside the sandbox entirely, a flaw tracked as CVE-2026-48124 and fixed in version 3.0.0.

Researchers frame it less as a sandbox bug and more as a fundamental trust problem: these tools were built to isolate the AI's actions, not to treat everything the AI writes to disk as untrusted input for the rest of the system — and that gap is exactly what a malicious repository can exploit.

Photo via Wikimedia Commons, © Jovonni Pharr, licensed under CC BY 3.0.