The Cursor bug Mindgard disclosed is almost embarrassingly simple, and that’s exactly why it’s worth sitting with. On Windows, opening a repository that contains a malicious git.exe in the project root gets that binary executed automatically — no click, no prompt, no approval dialog — and it recurs on a cadence as the IDE looks for git. Clone a repo, get arbitrary code execution.

This isn’t a model failure. The LLM didn’t hallucinate a shell command. It’s a plain trust-boundary bug: the tool treats everything in the workspace as trusted, including the executables it resolves off a relative path. I’ve argued before that most “prompt injection” incidents are really permissions bugs wearing a costume, and this is the non-AI twin of the same mistake. An agentic IDE runs code, reads code, and now searches for and executes binaries out of the same directory an attacker controls. If untrusted input and execution authority share a boundary, the boundary isn’t real.

The uncomfortable part is the “full disclosure” framing. When a tool with 7M+ users ships auto-execution of workspace binaries and the fix stalls, the researcher’s leverage collapses to going public. That’s a governance failure as much as an engineering one — coordinated disclosure only works if the other side coordinates.

For anyone shipping agent tooling: audit every place your harness resolves a path or spawns a process against workspace-relative locations, and assume the workspace is hostile. The HN discussion is split on whether this is a Cursor-specific miss or an industry-wide pattern in AI dev tools. My bet is the latter — how many other agent IDEs execute something out of a repo they just cloned before a human has read a line?