Thursday, July 16, 2026

A live code-execution 0-day in Cursor

Security firm Mindgard published full details of an unpatched arbitrary-code-execution flaw in the Cursor AI IDE on Windows. On project load, Cursor resolves the git binary by searching several locations including the workspace root, so a malicious git.exe planted in a repo root runs automatically as the current user, with no prompt, and repeatedly during normal operation. Mindgard demonstrated it with Calculator renamed to git.exe and says it last reproduced the bug on April 30, 2026 against Cursor 3.2.16. The firm reports disclosing on December 15, 2025 and getting no fix across seven months and 197 releases, despite Cursor’s CISO acknowledging a broken internal workflow and HackerOne confirming the report before communication stopped. Every timeline and response claim comes from Mindgard; the piece carries no comment from Cursor. Until a patch ships, enterprises can deny-list git.exe by path via AppLocker, and individuals should open untrusted repos only in a VM or Windows Sandbox.

AI coding tools spring leaks

The Cursor bug capped a day of coding-agent security failures.

Ayush Paul detailed The Memory Heist, a working proof-of-concept that exfiltrates personal data from Claude’s consumer assistant through its read-only web_fetch tool. Because web_fetch would follow links found on a fetched page, an attacker’s server could encode data one letter at a time into URL paths Claude traverses; a fake Cloudflare “turnstile” told Claude to spell out the user’s name, employer, and hometown to “authenticate,” then served a normal page so the leak went unseen. Anthropic said it had already found the issue internally, paid no bounty, and has since stopped web_fetch from following external links.
The Verge, citing Cereblab and The Register, reports SpaceXAI’s Grok Build CLI uploaded users’ entire repositories to Google Cloud, including gitignored files and secrets purged from git history. Cereblab says the vendor’s suggested fix, the /privacy command, is only a per-session retention toggle; its tests now show the upload disabled server-side, and Elon Musk said on X the data will be deleted.
A Codex CLI issue reports OpenAI’s MultiAgentV2 messaging now stores inter-agent tasks only as ciphertext and feeds it straight to the recipient model, leaving no readable record of what one agent asked another to do.

The volume is structural. Microsoft’s July Patch Tuesday fixed at least 570 flaws, nearly triple the prior record, and EVP Pavan Davuluri attributes the surge to AI finding “more issues, faster.” Tenable’s Satnam Narang argues the human-tuned exploitability index is failing: Anthropic’s red team reports its Mythos Preview model built working exploits for 13 of 14 bugs Microsoft rated unlikely to be exploited.

Where compute gets built, and who pays

New York became the first US state to pause hyperscale datacenters. Governor Kathy Hochul’s July 14 executive order freezes state permitting of facilities above 50 MW for one year and directs regulators to write environmental, energy, and water standards. She acted by order rather than signing a broader moratorium bill the legislature had already passed; Maine’s legislature passed a similar pause that its governor vetoed in April.

S&P sharpened the financial risk the same week, cutting Oracle to BBB-, one notch above junk, and naming OpenAI a “central credit risk”: about half of Oracle’s $638B undelivered cloud backlog rides on OpenAI, whose payments depend on the AI boom continuing. S&P forecasts about a $42B free-cash-flow deficit for Oracle’s FY2027 as capex guidance climbs to $90-95B.

Research and releases

A hobbyist RL-trained an agent whose action is writing full RL training jobs, with real GPU runs as the reward; reported reward rose from about 0 to a 0.63 peak over 54 steps and roughly 1,750 inner jobs, for about $1,275, with the checkpoint released.
An arXiv preprint reports a coding agent’s hidden states linearly encode whether an edit will parse or pass tests as many as 25 steps before it is written, reaching AUC 0.83 for correctness; the authors call it the “latent programming horizon.”
Mira Murati’s Thinking Machines released Inkling, its first open-weights model, a 975B-parameter MoE (41B active) with native audio input; the announcement includes no benchmarks or license terms.

What to watch today

Third-party app stores go live inside Google Play in the US on July 22; US developers’ listings are opted in by default unless they opt out, per The Verge.
Whether Cursor patches the 0-day or confirms Mindgard’s account; none as of 3.2.16.
New York regulators drafting datacenter environmental, energy, and water standards during the one-year pause.