Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-02-27 · source-backed
— Security researcher Ari Marzouk disclosed 30+ vulnerabilities (24 CVEs) affecting Cursor, GitHub Copilot, Windsurf, Zed, Kiro, Roo Code, Junie, and Cline. The devastating finding: every tested AI IDE is vulnerable because none accounts for autonomous LLM agent behavior in their threat model. Universal attack chains enable RCE and data exfiltration across all tools. Separately, Zed shipped two symlink sandbox escape CVEs (CVE-2026-27967, CVE-2026-27976). Builder action: treat your IDE as an untrusted execution environment. (SC Media, GitHub Advisory)
Each link below shares sources, entities, or timing with this story.
The IDEsaster disclosure reveals 30+ vulnerabilities (24 CVEs) across Cursor, Copilot, Windsurf, Zed, Kiro, Roo Code, Junie, and Cline. The fundamental finding: 100% of tested AI IDEs are vulnerable because none accounts for autonomous LLM agent behavior in their threat model....
The Amazon Q bug is one instance of a 2026 pattern: MCP configuration carried in repositories is now an RCE supply-chain vector, not just untrusted tool output. Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI are all vulnerable to MCP-based auto-launch attacks (Windsurf...
Roo Code announced it will archive its VS Code extension repo on May 15 and merge back into Cline, the project it originally forked from. CEO Matt Rubens said the team needs to "constantly destroy and recreate to keep up with what's newly possible." Translation: the extension...
The Rust account manager covers Antigravity, Codex, GitHub Copilot, Windsurf, Kiro, Cursor, Gemini CLI and CodeBuddy with quota monitoring and multi-instance management, at 17,081 stars. A 1:10 PR-to-issue ratio means almost all inbound traffic is user reports, and the obvious...
OX Security weaponized CVE-2025-7656 (a patched Chromium flaw) against current versions of both IDEs, proving their Electron builds ship Chromium engines frozen since March 2025. At least 94 known CVEs have accumulated since. Cursor dismissed the report as "out of scope." Wind...
A Chinese-enhanced fork of the 116K-star Superpowers pack, explicitly targeting 16 AI coding tools including Claude Code, Copilot CLI, Hermes Agent, Cursor, Windsurf, Kiro, and Gemini CLI. Source: GitHub The agent-skills layer is becoming portable across editors instead of loc...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.