Prompt Injection — Cybersecurity News

Critical Cursor IDE Flaws Enable Full Sandbox Escape and Remote Code Execution

RedSide Security July 01, 2026 Vulnerability 42 views

Two critical vulnerabilities in Cursor IDE, tracked as CVE-2026-50548 and CVE-2026-50549, allow attackers to escape the platform's sandbox and achieve full remote code execution through prompt injection. The flaws demonstrate how AI-driven coding agents can expose traditional software attack surfaces, leading to system compromise without user approval.

GuardFall Bypass Lets Attackers Evade AI Coding Agent Safety Checks Using Decades-Old Shell Tricks

RedSide Security June 30, 2026 Cybersecurity 50 views

Researchers have disclosed GuardFall, a shell command bypass technique that defeats safety protections in 10 popular AI coding agents. The flaw allows malicious commands to evade text-based filters and execute with user privileges, potentially exposing credentials, source code, and cloud infrastructure.

Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories

RedSide Security June 05, 2026 Cyber Attacks 73 views

A critical flaw in Anthropic's Claude Code GitHub Action allowed attackers to potentially hijack repositories through a single GitHub issue. The vulnerability combined weak bot validation, prompt injection, and excessive workflow permissions, highlighting the growing security risks of AI-powered CI/CD automation.

Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website

RedSide Security March 27, 2026 Vulnerability 278 views