Three weeks. Six vulnerability classes. The same root cause every time. Between late July and mid-August 2026, security researchers disclosed a wave of critical flaws spanning Cursor, AWS Kiro, GitHub Agentic Workflows, and six coding assistants simultaneously via a shared symlink attack. The common thread — the entry point is content the agent reads, not code the attacker runs — is not a bug you can patch your way out of. It is a structural property of how agentic AI works, and the industry is only beginning to face that.
The Pattern Behind the Pattern #
Every AI coding agent is designed to read things and act on them. That is the point. The problem is that “things” now includes attacker-controlled content — a web page, a GitHub issue, an MCP server response, a repository README — and there is typically no trust boundary between what the agent reads from a developer’s trusted files and what it reads from the external world. When attacker instructions get into that context, the agent follows them using its legitimate tools. The agent is not compromised. It is working exactly as designed.
GhostApproval: Six Tools, One Flaw #
On July 8, 2026, Wiz Research disclosed GhostApproval — a symlink-based attack that affected six widely used AI coding assistants simultaneously: Amazon Q Developer, Claude Code, Cursor, Windsurf, Augment, and Google Antigravity. The attack is straightforward. A malicious repository includes a file that looks innocuous — project_settings.json
— but is actually a symlink pointing to a sensitive location on disk, like ~/.ssh/authorized_keys
. The developer asks their agent to “set up the workspace” or follow the README. The agent follows the symlink. The approval dialog shows the safe-looking name. The write goes to the real target.
Vendor responses split sharply. Amazon, Google, and Cursor shipped fixes. Augment and Windsurf acknowledged the reports and then went quiet. Anthropic disputed the finding entirely — arguing that users who trust a directory and approve an edit “own that decision,” placing the scenario outside their threat model. That argument ignores the core issue: the approval dialog shows the wrong path. The user is not making an informed decision. They are approving something the agent is misrepresenting.
Cursor DuneSlide: Two CVSS 9.8s #
Cato AI Labs disclosed DuneSlide — two independent critical flaws in Cursor IDE, CVE-2026-50548 and CVE-2026-50549, both carrying CVSS 9.8 scores. Both are zero-click: the victim needs only issue a normal prompt that ingests attacker-controlled content, such as a poisoned web search result or a malicious MCP server response.
CVE-2026-50548 is particularly instructive. Cursor’s run_terminal_cmd
tool includes a working_directory
parameter that is LLM-controlled. A prompt injection can set it to any path — including the directory containing Cursor’s own sandbox helper binary. The agent then writes attacker content to the cursorsandbox
binary itself, neutralizing sandbox restrictions for every subsequent command in that session. OS-level remote code execution from a normal coding session. Both flaws are patched in Cursor 3.0.
AWS Kiro: The Agent That Edited Its Own Trust Boundary #
This one is the most structurally troubling. Intezer Research found that hidden text on a web page — invisible to users via CSS — could inject instructions into Kiro’s context. The agent would then silently rewrite ~/.kiro/settings/mcp.json
, the file that defines which external tools and servers Kiro trusts. No approval dialog. Kiro reloads MCP config automatically. The attacker’s server executes with full developer privileges.
CVE-2026-10591, fixed in Kiro 0.11.130. Worth noting: this is the third time different researchers found the same attack shape in Kiro. On launch day in July 2025, Johann Rehberger demonstrated the same mcp.json write-to-execution move. The pattern kept working for over a year. When an agent can edit the file that defines what it is allowed to execute, you do not have a security model — you have a suggestion.
GitLost: No Exploit Code Required #
Noma Security Labs disclosed GitLost on July 6, 2026 — a prompt injection attack against GitHub Agentic Workflows that requires no code, no credentials, and no account compromise. The attacker creates a public GitHub issue with hidden instructions written in plain English. If the organization’s AI agent is configured to read and respond to issues — common for developer bots — and has permissions to read both public and private repos in the same org, the agent reads the issue, fetches the contents of a private repository, and posts them as a public comment.
GitHub Agentic Workflows launched in February 2026, combining GitHub Actions with AI agents. The feature moved fast. The trust model did not keep up.
Langflow CVE-2026-9198: On the CISA Known Exploited List #
The most immediately urgent item. IBM disclosed CVE-2026-9198 in Langflow on July 17, 2026 — a CVSS 9.8 flaw that allows unauthenticated attackers to chain two endpoints and achieve full remote code execution on default Langflow deployments. CISA added it to the Known Exploited Vulnerabilities catalog on August 4, 2026. As of this writing, 650 exploitation attempts have been recorded from 244 attacker IPs across 41 countries.
Langflow is an AI orchestration platform that typically holds model API keys, database credentials, and connector tokens for every service it is wired into. RCE means total credential exposure. If your team runs Langflow, upgrade to version 1.10.1 immediately.
What to Do Right Now #
The containment mindset matters more than any individual patch. Assume prompt injection will succeed at some point. Design agent permissions so that a compromised agent cannot cause disproportionate damage.
Update immediately: Cursor 3.0+, Kiro 0.11.130+, Langflow 1.10.1+Clone untrusted repos safely:git clone --config core.symlinks=false
strips symlinks on clone, blocking GhostApproval-style attacksTreat mcp.json as a security-critical file: Audit which MCP servers you have authorized and remove any you cannot verifyScope GitHub agent permissions tightly: No blanket cross-private-repo read access for automated agentsRead approval dialogs carefully: Confirm the path shown matches where you actually expect a write to goSandbox your agents: Run them in containers or restricted accounts without access to your full filesystem or production credentials
Six vulnerability classes in three weeks is not a bad streak. It is a signal. The security research community has started treating AI coding agents as serious targets. Developers should start treating them as serious risks.