Three AI coding agents were compromised this summer through the same attack. No passwords stolen. No phishing links clicked. The attacker just needed the AI to read the wrong web page. Cursor, AWS Kiro, and GitHub’s agentic workflows all fell to prompt injection — a class of attack that exploits the same feature that makes these tools useful: they read external content and act on it. The trouble is, they can’t tell the difference between data and instructions. Here’s what happened and what you need to do before your session becomes the next case study.
DuneSlide: Cursor’s Sandbox Was Overwritable #
In February, researchers at Cato AI Labs disclosed two zero-click remote code execution vulnerabilities in Cursor IDE — CVE-2026-50548 (CVSS 9.8) and CVE-2026-50549 (CVSS 9.3). They named the pair DuneSlide, and the name fits: once the attacker gets a foothold in the context window, everything slides.
The attack didn’t require privileged access or user action. It only needed Cursor to ingest attacker-controlled content — an MCP server response, a poisoned search result, a malicious README — and then make a single prompt that included a crafted working directory parameter. Cursor’s run_terminal_cmd
tool accepted non-default paths and added them to sandbox allowlists without validation. The result: the LLM could be directed to overwrite the cursorsandbox
binary itself, stripping all sandbox restrictions from every command that followed.
The second flaw worked differently but hit the same target. When a symlink lacked read permissions, Cursor’s path canonicalization fell back to the unresolved symlink path. An attacker could plant a write-only symlink inside an allowed project directory, pointing it at the sandbox binary. Cursor followed it, overwrote the binary, sandbox gone.
Full impact: shell access at the OS level, plus compromise of any connected SaaS workspaces — GitHub, Vercel, AWS. More than half the Fortune 500 runs Cursor. Worth noting: when researchers first reported this in February, Cursor rejected it. The threat model didn’t account for MCP server misuse. That detail matters — it reflects an industry assumption that the sandbox protects against what the agent writes, not what it reads. Cursor 3.0 (April 2, 2026) patches both flaws. If you’re on an earlier version, update now.
Kiro: The Agent Rewrote Its Own Trust Boundary #
AWS Kiro’s vulnerability (CVE-2026-10591) is more elegant and more disturbing. The attack required no special tooling — just a web page with hidden white text.
A researcher at Kodem Security embedded malicious instructions in a normal-looking documentation page using trivial CSS: color:#fff; font-size:1px
. Humans see nothing. The LLM parses raw HTML and reads the hidden content as legitimate instructions. Those instructions directed Kiro to use its built-in fsWrite
tool to modify ~/.kiro/settings/mcp.json
— the file that defines which MCP servers Kiro should launch. That file required no user approval to modify.
When Kiro reloaded its configuration automatically, the newly registered “telemetry” MCP server started, executing the attacker’s code with developer privileges. The proof of concept exfiltrated hostname, username, and platform data. Kodem’s analysis named the core problem precisely: “The file that decides what code Kiro will execute is itself writable by the agent without review.” The attacker didn’t hack Kiro. They made Kiro hack itself. Patch: Kiro 0.11.130, released April 3.
GitLost: No Patch, No Timeline #
GitHub’s Agentic Workflows — in public preview since February 2026, supporting Claude, Copilot, Gemini, and Codex as backends — have a prompt injection problem that GitHub cannot patch in the traditional sense.
Noma Security demonstrated GitLost: create a public issue in any public repository owned by the target organization. Embed instructions in the body. The workflow reads the issue, mistakes the attacker’s commands for legitimate owner instructions, and posts private repository contents as a public comment. No authentication. No write access needed. A free GitHub account is sufficient.
GitHub did implement output scanning before agents post comments. Researchers bypassed it by prefixing the malicious instructions with “Additionally” — the model treats follow-up text as a task, not a threat. Sasi Levi, security research lead at Noma, put it directly: “GitLost is about manipulating what an agent does with its permissions, not just what it says.”
There is no CVE, no patch, and no timeline. GitHub classifies this as an architectural limitation. The correct mitigation is access control: scope workflow tokens to individual repositories, not org-wide, and gate agent outputs behind human review before they’re posted publicly.
The Shared Flaw #
All three attacks exploit the same property: AI agents trust their context window unconditionally. They cannot distinguish between “content I’m reading” and “instructions I should follow.” That’s not a bug in Cursor or Kiro or GitHub’s implementation — it’s how large language models work. Every agent that reads external content and takes actions is in this threat category.
Prompt injection attacks rose 340% in 2026. Eighty-eight percent of organizations reported a confirmed or suspected AI agent security incident in the past year. The six CVEs from January became 35 by March, and researchers estimate the real count is five to ten times higher. The trend line is not ambiguous.
What to Do Now #
Immediate:
- Update Cursor to 3.0 or later — DuneSlide is patched.
- Update AWS Kiro to 0.11.130 or later — CVE-2026-10591 is patched.
- Scope GitHub Agentic Workflow tokens to individual repositories. Org-wide read access turns every public issue into a potential exfiltration vector.
Ongoing:
- Treat agent inputs as hostile. Web search results, README files, issue bodies, MCP server responses — any of these can carry injected instructions. Design your agent workflows accordingly.
- Gate sensitive operations behind human approval. An agent that proposes an action and waits for confirmation is substantially harder to weaponize than one that executes autonomously.
- Separate reasoning from execution. An agent that analyzes context and produces recommendations, but cannot itself execute, cannot be turned into an execution vector through prompt injection.
The developer community built sandboxes to protect against what AI agents write. The attacks this summer showed the real gap: what they read. That assumption needs to be revisited for every agent you deploy. Start with the patches. Then start treating every context window as a potential attack surface — because attackers already are.