The pitch for AI code editors like Cursor is that they read everything for you, your repository, your open issues, the web page you pasted in, and act on it. Last week, researchers at Cato AI Labs showed what happens when that reading becomes the attack.

The two flaws they found, reported by The Hacker News and named DuneSlide, let a single ordinary-looking prompt escape Cursor's safety sandbox and run commands directly on the developer's machine. There is no link to click and no permission box to approve. The malicious instruction simply rides inside content the AI was asked to process, and the AI does the rest. Cato tracked the pair as CVE-2026-50548 and a companion flaw, and Cursor has since shipped a fix.

What makes this more than one vendor's bug is the category it belongs to. Prompt injection is usually discussed as a content-moderation nuisance, a way to make a chatbot say something it should not. Here it is remote code execution. As AI assistants gain permission to read and run things inside developer environments, the blast radius of a single crafted prompt grows to match, and the tools writing your code quietly become part of your threat model.

Update Cursor now if you use it, and until you are sure, treat any session on an untrusted repository as a privileged one. The longer lesson is that AI tooling has to be tested as adversarially as any other software that can execute code, including the prompt-injection paths no traditional scanner thinks to look for.

Sources: The Hacker News and SecurityWeek, with the flaws discovered by Cato AI Labs.