Cases › security breach › LR-2026-0649
Cursor git.exe repo-poisoning zero-day patched without advisory or CVE
Preliminary Why: 1 report: Tech Times · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: action reported, no fix
No source states: loss or records, agent tool, could do, deployer, industry.
Severity major: Test: many third parties (a stated count of two or more affected parties). Fact: the source states the flaw affects 7 million users.
Cursor, an AI coding IDE on Windows, ran a file named git.exe planted at the root of a cloned repository. When Cursor loads a project it issues a Git introspection call and searches the workspace for a Git binary, so the planted file ran with the developer's full privileges and no prompt. Mindgard discovered the flaw on December 15, 2025 and reported it to Cursor; the report drew no confirmation and was later closed as out of scope before HackerOne reopened it. Mindgard demonstrated the flaw with a renamed Calculator binary. Cursor quietly fixed the flaw on July 13, 2026, and as of July 17 it had issued no advisory or CVE. Mindgard published its full technical disclosure on July 14, 2026, 213 days after the initial report.
What happened
No source tells the story step by step yet.
What was done
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Similar incidents
Evidence
- When it was found 2025-12-15
- Cause a permission, scope or wiring error
No source states: what the AI was doing, what went wrong, what it reached or did, how it was caught, when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.
Show the full account: 5 items from the primary sources
What happened, in order
- 2025-12-15 Mindgard discovers the flaw and reports it to Cursor's security email; no confirmation arrives.
- January 20 HackerOne reopens the report after Mindgard's challenge and confirms the details were delivered to Cursor.
- 2026-06-01 Mindgard tells HackerOne it intends to go public.
- 2026-07-13 Cursor quietly fixes the flaw.
- 2026-07-17 Cursor has issued no public advisory, CVE or patched version number.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
Patched version number is not stated. Controls I5 and J1 are inferred from the stated failures; E1 is inferred from the advice to use a sandbox. The DeepJack and other Adversa AI and Cymulate findings are separate incidents and are excluded. Dark Reading, The Hacker News and other outlets are cited by the source but not provided.
LR-2026-0649 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON