Cursor-Ide

Kimsuky Runs Offline LLMs to Sharpen Phishing, Build Malware

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Aug 16, 2026

North Korean APT group Kimsuky has assembled a private, offline AI stack — including Ollama, GPT4All, and RAG tooling — to enhance spear-phishing lure quality and automate malware development in C#/.NET. South Korean firm Genians found configured instances of these tools on Kimsuky-linked infrastructure, alongside developer libraries such as LLaMaSharp and Microsoft Semantic Kernel, indicating deliberate integration of AI into the group's attack pipeline. The shift erodes traditional phishing detection signals like poor grammar and formatting, forcing defenders to pivot toward behavioural indicators on the endpoint.

GhostSplice MCP Attack Splits Prompts to Exfiltrate SSH Keys

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Aug 16, 2026

ASSET Research Group has disclosed GhostSplice, a technique that fragments malicious instructions across multiple Model Context Protocol (MCP) server channels to evade AI coding assistant safety filters and trigger secret exfiltration. By splitting a theft request into individually innocuous pieces placed in tool descriptions and tool results, the attack raised average model compliance from 42% to 82% across eleven tested models. The research highlights that host-side safety controls matter as much as model-level refusals, with the same model behaving differently across coding clients.

AI Coding Agents Exploited via Hallucinated Package Names

ATLAS OWASP HIGH ▲ 8.5 BleepingComputer Jul 26, 2026

Researchers from Tel Aviv University, Technion, and Intuit have demonstrated that AI coding agents across tools like Cursor, Copilot, and Gemini CLI predictably hallucinate package, domain, and repository names that attackers can pre-register to deliver malicious code. The attack—variously branded slopsquatting, phantom squatting, and HalluSquatting—requires no phishing, no stolen credentials, and no direct user interaction, only an automated agent with permission to fetch external resources. Because agents handle delivery autonomously and hallucinations are reproducible at up to 100% consistency, the technique scales to botnet-level compromise without traditional malware infrastructure.

CVE-2026-12958: GhostApproval Symlink Attack on Coding Agents

ATLAS OWASP HIGH ▲ 8.7 The Hacker News Jul 09, 2026

Wiz researchers disclosed GhostApproval, a symlink-based attack affecting six AI coding assistants — Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf — that allows malicious repositories to write attacker-controlled content to sensitive files such as SSH authorized_keys or shell startup scripts. The core failure is an informed-consent bypass: the agent's approval dialog names a harmless file while the write targets a sensitive one, or in some tools the write completes before any prompt appears. Three vendors have patched, two have not, and Anthropic disputes the classification as a vulnerability.

DPAPI Abuse in Claude Code and Cursor Triggers EDR

ATLAS OWASP HIGH ▲ 8.2 The Hacker News Jul 09, 2026

Sophos telemetry from June 2026 reveals that AI coding agents including Claude Code, Cursor, and OpenAI Codex are triggering endpoint detection rules designed to catch human attackers, performing actions such as DPAPI-based credential decryption, Windows Credential Manager enumeration, and persistence via startup folder writes. The behaviour is not malicious in intent, but the agents exhibit attacker-like pivot-when-blocked logic and abuse legitimate Windows utilities in ways indistinguishable from living-off-the-land intrusions. This blurring of the line between benign automation and attack tradecraft creates significant noise for defenders and may erode confidence in high-fidelity detection rules.

Cursor IDE DuneSlide Zero-Click Prompt Injection RCE

ATLAS OWASP CRITICAL ▲ 9.2 SecurityWeek Jul 04, 2026

A set of vulnerabilities dubbed 'DuneSlide' in the Cursor AI code editor allow attackers to conduct zero-click prompt injection attacks that escape the application's sandbox and execute arbitrary code at the operating system level. The flaws represent a critical escalation of AI-native attack surface risks, targeting developers who rely on AI-assisted coding environments. Because exploitation requires no user interaction, the attack chain is particularly dangerous in supply chain and watering-hole scenarios.

CVE-2026-50548: Cursor IDE Prompt Injection RCE

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Jul 03, 2026

Two critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the Cursor AI code editor allow prompt injection attacks delivered via MCP services or web search results to escape the editor's terminal sandbox and execute arbitrary commands on a developer's machine without any user interaction. Both flaws abuse the sandbox's write-permission logic — one through a misconfigured working directory parameter, the other through a symlink-resolution fallback — ultimately allowing overwrite of the sandbox helper binary itself. The attack surface is significant given Cursor's reported adoption across more than half of Fortune 500 companies; all versions prior to 3.0 remain vulnerable.