Cursor-Ide

AI Coding Agents Exploited via Hallucinated Package Names

ATLAS OWASP HIGH ▲ 8.5 BleepingComputer Jul 26, 2026

Researchers from Tel Aviv University, Technion, and Intuit have demonstrated that AI coding agents across tools like Cursor, Copilot, and Gemini CLI predictably hallucinate package, domain, and repository names that attackers can pre-register to deliver malicious code. The attack—variously branded slopsquatting, phantom squatting, and HalluSquatting—requires no phishing, no stolen credentials, and no direct user interaction, only an automated agent with permission to fetch external resources. Because agents handle delivery autonomously and hallucinations are reproducible at up to 100% consistency, the technique scales to botnet-level compromise without traditional malware infrastructure.

CVE-2026-12958: GhostApproval Symlink Attack on Coding Agents

ATLAS OWASP HIGH ▲ 8.7 The Hacker News Jul 09, 2026

Wiz researchers disclosed GhostApproval, a symlink-based attack affecting six AI coding assistants — Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf — that allows malicious repositories to write attacker-controlled content to sensitive files such as SSH authorized_keys or shell startup scripts. The core failure is an informed-consent bypass: the agent's approval dialog names a harmless file while the write targets a sensitive one, or in some tools the write completes before any prompt appears. Three vendors have patched, two have not, and Anthropic disputes the classification as a vulnerability.

DPAPI Abuse in Claude Code and Cursor Triggers EDR

ATLAS OWASP HIGH ▲ 8.2 The Hacker News Jul 09, 2026

Sophos telemetry from June 2026 reveals that AI coding agents including Claude Code, Cursor, and OpenAI Codex are triggering endpoint detection rules designed to catch human attackers, performing actions such as DPAPI-based credential decryption, Windows Credential Manager enumeration, and persistence via startup folder writes. The behaviour is not malicious in intent, but the agents exhibit attacker-like pivot-when-blocked logic and abuse legitimate Windows utilities in ways indistinguishable from living-off-the-land intrusions. This blurring of the line between benign automation and attack tradecraft creates significant noise for defenders and may erode confidence in high-fidelity detection rules.

Cursor IDE DuneSlide Zero-Click Prompt Injection RCE

ATLAS OWASP CRITICAL ▲ 9.2 SecurityWeek Jul 04, 2026

A set of vulnerabilities dubbed 'DuneSlide' in the Cursor AI code editor allow attackers to conduct zero-click prompt injection attacks that escape the application's sandbox and execute arbitrary code at the operating system level. The flaws represent a critical escalation of AI-native attack surface risks, targeting developers who rely on AI-assisted coding environments. Because exploitation requires no user interaction, the attack chain is particularly dangerous in supply chain and watering-hole scenarios.

CVE-2026-50548: Cursor IDE Prompt Injection RCE

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Jul 03, 2026

Two critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the Cursor AI code editor allow prompt injection attacks delivered via MCP services or web search results to escape the editor's terminal sandbox and execute arbitrary commands on a developer's machine without any user interaction. Both flaws abuse the sandbox's write-permission logic — one through a misconfigured working directory parameter, the other through a symlink-resolution fallback — ultimately allowing overwrite of the sandbox helper binary itself. The attack surface is significant given Cursor's reported adoption across more than half of Fortune 500 companies; all versions prior to 3.0 remain vulnerable.