{"uuid": "08fd7152-abb5-4ff2-811c-8833def1d093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26268", "type": "seen", "source": "https://bsky.app/profile/aksharma98.bsky.social/post/3mtkwnlubwc2y", "content": "Cursor shipped a zero-click RCE (CVE-2026-26268) \u2014 clone a malicious repo and the AI agent runs attacker code via Git hooks, no clicks needed.\n\nSame month: AWS Kiro rewrote its own MCP config from hidden webpage text.\n\nYour IDE is now an attack surface nobody threat-modeled.", "creation_timestamp": "2026-08-21T04:34:34.625975Z"}