Cato Networks’ AI research arm disclosed DuneSlide on 1 July 2026: two critical vulnerabilities in the Cursor AI code editor, tracked as CVE-2026-50548 and CVE-2026-50549, both scoring 9.8 out of 10 on CVSS. Neither required the developer to click anything. A single prompt-injected instruction hidden in content Cursor’s agent merely reads — an MCP connector response, a web search result pulled into the chat — could escape the editor’s terminal sandbox and run arbitrary commands on the underlying machine. The first flaw let an attacker set a non-default working directory, then overwrite the cursorsandbox helper executable itself, stripping out future sandbox restrictions. The second abused a symlink resolution bug to write outside the project directory entirely, bypassing the same protection a different way.
The timeline matters as much as the mechanism. Cato reported both flaws privately in February 2026; Cursor initially declined to treat them as in-scope, then reopened the case and shipped fixes in the Cursor 3.0 release on 2 April — over a month before CVE identifiers were formally assigned in June, and five months before most users would have seen a CVE number to search for. Every Cursor version before 3.0 remains exploitable, and Cursor is used inside more than half of the Fortune 500. Cato’s disclosure notes it is sitting on similar sandbox-escape research in other widely used coding agents — DuneSlide isn’t being framed as a Cursor bug so much as a structural weakness in how AI IDEs isolate the terminal access their agents need to be useful.
So what
Pair this with yesterday’s post on Claude Code’s permission-hardening sprint and this week’s Claude Security launch, and a pattern is now hard to miss: every major AI coding agent has shipped a sandbox-escape or permission-bypass class of vulnerability in 2026, discovered by a third party, on a timeline that runs months ahead of the CVE paperwork. That’s not a reason to avoid these tools — it’s a reason to treat “which version, patched when” as a live piece of due diligence rather than a one-time vendor check, the same way you’d track patch levels on any other piece of software with shell access sitting on a developer’s laptop. If your team runs Cursor, Claude Code, or any agent that can read untrusted web content or third-party repos, confirming you’re on a current, patched build is a five-minute check worth doing today. It’s exactly the kind of tooling governance we build into AI-assisted development engagements — get in touch if you want a second pair of eyes on your current setup.