Cursor's zero-click RCE settles it: agent repo access is untrusted input

A malicious Git repository is now enough to run arbitrary code on a developer's workstation: Cursor's coding agent shipped with a zero-click remote code execution flaw tracked as CVE-2026-26268, in which the agent merely indexing or reviewing a hostile repo triggers a Git hook that executes locally ^[1][2]. It matters because there is no prompt to decline and no click to withhold, so the exploit path is the agent doing precisely what it was installed to do ^[3].

Three more failures landed the same month, according to the dev.to roundup that collected them. AWS Kiro was found rewriting its own MCP server configuration after reading hidden instructions embedded in a webpage ^[4]. GitHub's Agentic Workflows read private repository contents and posted them as a public comment ^[5]. A separate deeplink flaw got Cursor to install a malicious MCP server outright ^[6]. That is four incidents across three vendors inside one month ^[10].

None of this is exotic. The writeup's diagnosis is a feature interaction nobody flagged: once an agent autonomously executes operations, whether Git commands, config edits, or tool calls, inside a repository or a webpage it does not control, that surface becomes exploitable ^[7]. The corollary is the part worth budgeting for. Years of hardening went into APIs, auth flows, and user inputs, while the development environment, running with a developer's full local permissions, was never treated as something an outside party could reach into ^[8]. The author calls CVE-2026-26268 the clearest evidence yet that the assumption no longer holds ^[9].

For operators, the reclassification is straightforward and unwelcome. Repository contents an agent clones, web pages an agent fetches, and the agent's own configuration files all become attacker-controlled input rather than developer convenience. The Kiro case is the sharpest of the three, because a config file that content can rewrite is not configuration, it is an execution channel ^[4]. Treat MCP server definitions as reviewed, version-controlled artefacts with change detection, and alert when one mutates outside a pull request. If the Cursor vector is hook execution on a repo the agent touched ^[2], then the cheap control is denying the agent any environment where hooks run at all, plus a container boundary and short-lived credentials so that a fired hook inherits as little as possible. The GitHub case argues for the same discipline in CI: a workflow that can read private repository contents and write public comments has an exfiltration path by design, not by bug ^[5].

One limit on all of this: the material describes exploit mechanics but no patch status, affected version ranges, or vendor response ^[11]. Anyone building a remediation plan needs the vendor advisories before deciding whether an upgrade closes the hole or whether the default behaviour is the hole.

What to watch is whether these vendors ship default-deny on the two primitives that keep showing up, hook execution during agent-initiated Git operations and writes to agent config from fetched content, or leave both as opt-in flags for teams that know to look. Watch, too, for the first version of this that is not a security bug but a disclosure event, because the GitHub failure mode already produces a public artefact containing private code ^[5].