sandbox-bypass 2 Prompt Injection leads to RCE and Sandbox Escape in Antigravity Apr 26, 2026 Cursor Allowlist Bypass (CVE-2026-22708) Jan 14, 2026