Sandbox escape via tampered Python virtual environments

Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment’s Python executable with a malicious wrapper. When the Microsoft Python extension invokes that interpreter outside the sandbox, the wrapper can execute arbitrary host commands with the user’s privileges, including modifying files outside the workspace and launching applications.