Cursor — Cyber Attacks, Breaches & Threat Activity

Related Threat Clusters

• Jscrambler npm Package Compromised in Supply Chain Attack

  On July 11, 2026, multiple malicious versions of the jscrambler npm package were published, exploiting a compromised npm publishing credential. The affected versions (8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0) included…

  18 articles · Updated July 12, 2026
• Cursor IDE Vulnerability Allows RCE via Malicious Git Repositories

  A critical vulnerability in the Cursor IDE, tracked as CVE-2026-26268, has been disclosed, allowing arbitrary code execution (RCE) on developers' machines. The flaw arises from the interaction between Cursor's AI agent…

  3 articles · Updated April 29, 2026
• Vibe Coding Tools Found to Generate Critical Security Flaws

  A study by security startup Tenzai revealed that popular vibe coding platforms produce insecure code, including critical vulnerabilities, when responding to common programming prompts. The assessment, conducted in…

  3 articles · Updated January 14, 2026
• Critical RCE Vulnerabilities in Cursor IDE Enable Zero-Click Prompt Injection Attacks

  Cato AI Labs disclosed two critical remote code execution (RCE) vulnerabilities in Cursor IDE, tracked as CVE-2026-50548 and CVE-2026-50549. These vulnerabilities allow attackers to exploit zero-click prompt injection,…

  33 articles · Updated July 1, 2026
• HexagonalRodent Targets Web3 Developers with Social Engineering Attacks

  The Lazarus Group's HexagonalRodent faction is targeting Web3 developers using social engineering tactics, including fake job offers for high-paying remote positions and recruitment for well-known projects. These…

  2 articles · Updated April 25, 2026
• Glassworm Botnet Targeting Developers Disrupted by CrowdStrike and Google

  The Glassworm botnet, which has targeted software developers since early 2025, was taken down in a coordinated operation by CrowdStrike, Google, and the Shadowserver Foundation on May 26, 2026. This botnet utilized…

  30 articles · Updated May 27, 2026
• Google's Antigravity IDE Vulnerability Allows Remote Code Execution via Prompt Injection

  Researchers at Pillar Security discovered a critical prompt injection vulnerability in Google's Antigravity IDE, which allows for remote code execution (RCE) by exploiting insufficient input sanitization in the…

  4 articles · Updated April 20, 2026
• Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages

  A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into…

  680 articles · Updated April 29, 2026
• GhostApproval Vulnerability Exposes AI Coding Assistants to Remote Code Execution

  A vulnerability named GhostApproval has been discovered in six major AI coding assistants, including Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. This flaw allows…

  17 articles · Updated July 8, 2026
• AI-Driven Malware Framework Automates EDR Evasion Tactics

  Sophos X-Ops analysts uncovered a threat actor utilizing AI technologies to develop a malware-testing framework aimed at evading endpoint detection and response (EDR) systems. The activity was detected on June 2, 2026,…

  16 articles · Updated June 2, 2026

Recent Intelligence Reports

• Cursor 0day When Full Disclosure Becomes The Only Protection Left — mindgard.ai · July 17, 2026
• Cursor IDE Auto — Darkreading · July 14, 2026
• Someone Is Scanning for Your MCP Servers and AI Assistant Credentials, (Mon, Jul 13th) — Isc.Sans.Edu · July 13, 2026
• Spoofed Git Identity Ai Code Reviewer — www.manifold.security · July 12, 2026
• jscrambler npm hijack sweeps AI coding tool config keys — Aiweekly.Co · July 12, 2026
• GhostApproval — www.wiz.io · July 10, 2026
• Vulnerability in coding agents: access to arbitrary files via symlinks — Heise.De · July 9, 2026
• New GhostApproval Vulnerability Affects Amazon Q, Claude Code, Cursor, and Other AI Agents — Cybersecuritynews · July 9, 2026

Related Entities