AI Coding News: July 24, 2026 — Copilot CLI Ships v1.0.74, Pillar Security Exposes Sandbox Escapes

Today's AI coding tools news is dominated by two threads: GitHub's Copilot CLI graduating its Gemini 3.6 Flash and sandbox-opt-in work into a stable release, and a fresh cross-vendor security disclosure that shows how easily agentic coding tools can slip past their own sandboxes. Here's what shipped and what it means for anyone running AI coding agents in production.

GitHub Copilot CLI v1.0.74 Ships With Sandbox Opt-In and Gemini 3.6 Flash

GitHub shipped Copilot CLI v1.0.74 on July 23, 2026, promoting a run of pre-release changes into a stable build. The headline additions are a first-run splash screen for opting into the default sandbox and support for the gemini-3.6-flash model, but the release also cleans up a long list of day-to-day friction points:

• Added Open Plugin Spec v1 plugin manifest and mcp.json configuration support.
• IDE integration now reconnects reliably when the CLI reloads MCP servers or changes directory.
• Multi-turn subagent timelines now display every prompt and response in the correct order after reopening /tasks, and label which agent originated each message.
• The /mcp add and /mcp edit wizard now preserves = characters in environment variable values, a fix for anyone piping secrets or tokens through MCP config.
• A new /model plan command lets you pick the model used specifically in plan mode, separate from execution mode.
• Plan mode now allows session-folder planning artifacts while still blocking file mutations outside that folder.

Pillar Security's "Week of Sandbox Escapes" Hits Four Coding Agents

Researchers Eilon Cohen, Dan Lisichkin, and Ariel Fogel at Pillar Security published a research series called "The Week of Sandbox Escapes," reproducing sandbox breakouts across Cursor, OpenAI's Codex CLI, Google's Gemini CLI, and Google Antigravity. The finding that ties them together: none of the escapes attack the sandbox directly. Instead, the agent writes a file that a trusted tool outside the sandbox later reads, loads, or executes — turning a permitted write into an unsandboxed command.

The most striking finding is shared across three tools: a Docker socket that a privileged local daemon exposes outside the sandbox boundary, giving Codex CLI, Cursor, and Gemini CLI a common path to unsandboxed code execution. Per-tool findings and fixes:

• Cursor — virtualenv modification and Git config exploitation; patched in v3.0.0, with CVE-2026-48124 issued.
• Codex CLI — a Git command allowlist bypass; patched in v0.95.0, with a high-severity bounty awarded to the researchers.
• Gemini CLI — Docker socket access from inside the sandbox; resolved and tracked under advisory GHSA-v4xv-rqh3-w9mc.
• Antigravity — a denylist sandbox failure and a VS Code task-configuration bypass; Google classified both as lower-severity, judging them hard to exploit without social engineering or a maliciously prepped repo.

Coverage from BleepingComputer and CSO Online both underline the same takeaway: sandboxing the agent process isn't enough if the host still trusts what that process writes to disk.

OpenCode v1.18.4 Continues Its Desktop v2 Rollout

On the open-source side, OpenCode v1.18.4 landed July 20 with 15 changes — one feature, six improvements, and eight bug fixes — as the project keeps stabilizing the Desktop v2 layout it began migrating to earlier this month. Recent point releases in the v1.18.x line have focused on fixing subagent nesting, restoring the Help button, cleaning up home-page scrolling and command-palette search, and making sure the WSL server finishes loading before the desktop app reports itself ready.

Claude Code and Codex CLI: Quiet After Last Week's Big Drops

Neither Anthropic nor OpenAI shipped a new stable release today. Claude Code remains on v2.1.218 (July 22), which backgrounded /code-review into a subagent and fixed a Windows path-corruption bug, while Codex CLI is holding at v0.145.0 (July 21) after stabilizing multi-agent mode, adding audio input, and expanding /import for migrating Cursor and Claude Code settings. Given today's Pillar Security disclosures, expect both teams to ship sandbox-hardening patches in the next few days.

Why This Matters

The pattern across today's news is consistent: coding agents are maturing fast on features — better plan-mode controls, richer subagent visibility, plugin ecosystems — while their security model is still catching up to how much these agents are trusted to write to disk. If you run any of Cursor, Codex CLI, Gemini CLI, Antigravity, or Copilot CLI in a sandboxed or CI environment, treat the Pillar Security advisories as a today-not-later patching item, and don't assume a sandboxed process means a sandboxed blast radius.

Sources & Further Reading

• GitHub Copilot CLI v1.0.74 release notes
• Pillar Security — The Week of Sandbox Escapes
• BleepingComputer — Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
• CSO Online — AI agents can escape sandboxes without ever breaking them
• OpenCode v1.18.4 release notes
• Claude Code changelog (Anthropic docs)
• OpenAI Codex CLI releases (GitHub)