AI Coding Tools Face Critical Sandbox Escape and Agentjacking Threats

Two high‑severity vulnerabilities (CVE‑2026‑50548 and CVE‑2026‑50549) were found in the Cursor IDE, allowing an AI‑assisted coding agent to break out of its command sandbox and execute arbitrary code on a developer’s machine. The bugs, nicknamed DuneSlide, received CVSS scores of 9.8 and were patched in Cursor version 3.0 released in early April. The flaws arise from unchecked directory parameters and symlink handling, letting malicious input read by the AI overwrite sandbox helpers without any user interaction.

In a related development, researchers have identified a new “Agentjacking” attack‑vector where attackers embed hidden instructions in fake bug reports, GitHub issues, or ticketing tickets that AI coding agents then execute as if they were legitimate tasks. The technique leverages indirect prompt injection, works at low effort and across any agentic workflow that ingests external text, and bypasses traditional web‑application defenses. Proposed mitigations include content‑scrubbing layers such as Sentinel, which uses regex patterns to detect authority‑hijacking cues before the AI processes the input.