Three Incidents, One Attack Pattern

In the space of three weeks in July 2026, three critical vulnerabilities surfaced in tools that tens of millions of developers use every day: Cursor, AWS Kiro, and GitHub Agentic Workflows. Each attack looked different on the surface. Each exploited the same structural flaw.

The flaw is prompt injection — steering an AI agent’s behaviour by embedding instructions in content the agent is expected to read. What has changed is what agents can now do with those instructions. In 2024, a prompt injection in a chatbot might trick it into saying something embarrassing. In 2026, it can rewrite your MCP configuration, exfiltrate your private codebase, or execute arbitrary code on your machine without you clicking anything.

The security community has a name for this shift: the attack surface of AI coding agents is widening faster than the governance surrounding them.

DuneSlide: When Your IDE Becomes the Attacker

The most technically severe of the three incidents is DuneSlide, a pair of vulnerabilities in Cursor’s AI IDE tracked as CVE-2026-50548 and CVE-2026-50549 — both rated CVSS 9.8. Cato Networks researchers published the full technical breakdown; the short version is grim.

An attacker plants malicious instructions in content Cursor’s agent reads — a repository’s README, a documentation page, a third-party library. The agent follows the instructions, abusing Cursor’s path handling and symlink resolution to overwrite the cursorsandbox binary. From that point, every command the agent believes it’s running in a sandbox is actually running on the host OS, unsandboxed. Full system compromise, including connected SaaS workspaces, is reachable without the victim clicking anything. Cursor patched both CVEs in version 3.0.

Adversa AI separately documented DeepJack, a different class of Cursor attack that uses nested cursor:// deeplinks with whitespace-padded arguments to push malicious MCP installation commands off-screen in Cursor’s confirm dialog, enabling one-click unsandboxed RCE. Unlike DuneSlide, DeepJack had not been fully patched as of Adversa’s August report.

Kiro: A Web Page That Rewrites Your Config

AWS Kiro, the company’s agentic IDE launched in late 2025, shipped with a different but equally serious problem. Intezer researchers found that hidden text on a web page — rendered in one-pixel white-on-white, invisible to any human user — was sufficient to make Kiro rewrite its own mcp.json configuration file and launch an attacker-controlled MCP server with the developer’s full local privileges.

The mechanism mirrors DuneSlide at a higher level: Kiro, like all agentic IDEs, browses the web and fetches documentation as part of helping developers. Any URL becomes a potential prompt injection vector. AWS assigned CVE-2026-10591 (CVSS 8.8) and released a fix in Kiro v0.11.130. The vulnerability required no credentials, no installed malware, and no social engineering — just a developer asking the agent to visit a page the attacker controlled.

AWS also fixed three additional vulnerabilities in Kiro over the same period: CVE-2026-4295 (arbitrary code execution via maliciously crafted project directories), CVE-2026-0830 (command injection via workspace files), and CVE-2026-12958 (missing symlink validation enabling arbitrary file writes outside the workspace trust boundary). The broader symlink pattern — documented by Adversa AI as affecting six AI assistants tested — uses a malicious repo to make agents write outside the workspace while hiding the real target path from the approval dialog.

GitLost: Private Code, Public Comment

The third incident required no malware, no exploited binary, and no crafted file. On July 6, Noma Security disclosed GitLost: a prompt injection attack against GitHub Agentic Workflows that causes the agent to read private repositories and post their contents in a public comment — no credentials, no code, no access to the target organisation required.

GitHub Agentic Workflows, launched in February 2026, combine GitHub Actions automation with Copilot or Claude as the executing agent. The feature feeds issue titles and bodies directly to the agent as instructions. An attacker opens a normal-looking issue on any public repository in an organisation using Agentic Workflows with cross-repository access. The issue body contains plain-English instructions. The agent reads the issue, follows the instructions, reads private repositories in the same organisation, and posts what it finds publicly.

GitHub released a fix, but the underlying design decision — agents treating public issues as trusted input alongside private repository contents — reflects a broader architectural problem that a patch cannot fully solve.

The Structural Problem

What unites DuneSlide, Kiro, and GitLost is not a bug someone forgot to patch. It is a consequence of how agentic tools are designed.

Traditional developer tools are passive — they render content but do not act on it. AI coding agents are different: they read content and execute based on what they read. That creates a new trust-boundary problem. Code, documentation, web pages, issues, and file paths are all content the agent must read to do its job. Any of that content can carry instructions. Separating “data to read” from “instructions to follow” is an unsolved problem in prompt-based systems, and no amount of sandboxing fixes it if the agent can be instructed to overwrite the sandbox binary itself.

The permission problem compounds this. Agents are most useful when they have broad access: write to files, browse the web, install tools, read across repositories. That access is also what makes exploitation dangerous. As vortx.ch documented in July, the governance frameworks for AI agents — who they can act as, what they can access, and when to require human approval — are still largely absent from enterprise deployments. (AI Agents Are Live. Governance Is Still in the Lab.)

The Five Eyes advisory from July flagged exactly this trajectory: AI-enabled cyber threats arriving faster than defensive tooling. DuneSlide and Kiro are precisely the class of attack that advisory described.

What Security Teams Should Do Now

Three immediate actions matter most.

Update immediately. Cursor 3.0 patches DuneSlide. Kiro v0.11.130 patches CVE-2026-10591. GitHub has patched GitLost. Unpatched versions of these tools are actively exploitable. If your organisation manages developer machine configurations centrally, push the updates this week, not next sprint.

Audit agent permission scopes. GitHub’s GitLost was possible because the agent had cross-repository read access and the ability to write public comments. Reviewing what repositories, file paths, external tools, and network destinations each agent can reach is now a security task. The same applies to MCP server configurations, which control what local and remote tools an IDE agent can invoke. Least privilege for agents means something different than least privilege for humans — an agent with “read” access to ten repositories can potentially exfiltrate all ten in a single workflow run.

Treat agent-ingested content as untrusted. This is harder to operationalise. It means not letting agents browse arbitrary external URLs without isolation, auditing what third-party content agents are asked to read, and treating public-facing inputs — issues, pull request comments, web pages — as potential injection sources when the agent also has access to sensitive scopes. Shadow agent inventories (what agents are deployed, with what access, on whose credentials) are becoming a baseline security requirement. (Shadow Agents: How IT Teams Now Police Their Own AI.)

The deeper fix lies with the vendors: better content/instruction isolation, approval dialogs that cannot be manipulated by off-screen text, and sandbox architectures that remain intact when an agent is instructed to break them. That work is underway across the industry. It is not done.

Further Reading

• DuneSlide: Two Critical RCE Vulnerabilities in Cursor (Cato Networks) — the full technical breakdown of CVE-2026-50548 and CVE-2026-50549, including the exploit chain from prompt injection to host OS compromise.
• When the AI Edits Its Own Trust Boundary (Intezer) — detailed writeup of the Kiro mcp.json rewrite vulnerability, with screenshots of the hidden web page text used in the attack.
• GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos (Noma Security) — the original disclosure, with a full demonstration of the attack and recommended mitigations for organisations using Agentic Workflows.