Cursor's Seven-Month-Old Git.exe Zero-Day Creates a New Business: Security Audits for Teams Running AI Coding Agents Against Untrusted Repos.

A researcher just published a disclosure that most teams running AI coding agents will never see coming: Cursor, on Windows, "automatically executes a malicious git.exe binary placed in a repository root with no user interaction, warnings, or prompts," resulting in arbitrary code execution.

That is a gift to anyone who wants to sell security audits for teams that run AI coding agents against code they did not write.

What the researcher found

The bug was reported on December 15, 2025. Per the disclosure timeline, an initial HackerOne submission followed in mid-January 2026, multiple update requests between February and April 2026 drew no response, and the researcher announced intent to publish on June 1, 2026 before releasing the full write-up on July 14, 2026. Across that window, the researcher says the issue "persists through 197+ new versions" of Cursor with no fix and no user-facing warning. The researcher frames the underlying pattern as structural rather than a one-off: Cursor "repeatedly invoked executable content from inside the workspace during normal operation," meaning any repo a user opens — including one they cloned to review a stranger's pull request — can silently run code the moment the IDE touches it.

Cursor is not a niche tool. The disclosure cites Cursor's own reported numbers: "7 million+ active users, 1 million+ daily, 1 million+ paying, used by 50K+ companies," with a reported market valuation of "$60 billion." A silent, unpatched, arbitrary-code-execution bug living inside a tool at that scale for seven months is exactly the kind of gap that makes a security audit an easy sell to any engineering leader who reads the disclosure.

The business idea

Most engineering teams that adopted an AI coding agent picked it for speed, not for a security review of how it handles untrusted input. They open PR branches, clone dependencies, and let the agent index and execute inside those repos without ever asking what happens if the repo itself is hostile.

That gap is the service: a fixed-scope attack-surface audit that tests a client's actual coding-agent stack against exactly the class of bug this disclosure describes, then packages the fix.

Money play

1. Sell a fixed-scope "AI coding agent attack-surface audit" that clones a deliberately hostile test repo into a client's actual IDE/agent setup and documents what executes without a prompt, using the git.exe finding as the reproducible baseline test.

2. Package a "vendor disclosure monitoring" retainer, since this bug sat through "197+ new versions" without a public warning — most teams have no process for tracking HackerOne reports against the specific tools their engineers run daily.

3. Offer an immediate remediation package — workspace-trust policies, sandboxed clone-and-review steps, git config hardening — for teams that need mitigation now and can't wait on a vendor's patch timeline.

4. Build the hostile test repo once, as a reusable product: a fixed set of auto-execution triggers (binaries, git hooks, extension manifests) that becomes the audit's core deliverable across every client instead of custom work each time.

5. Open every pitch with the scale numbers: a $60 billion, 50,000-company tool ran seven months on a silent code-execution bug. If it can happen there, no team should assume their own coding agent's defaults are safe without an independent check.

Bottom line

This disclosure did the unglamorous work most teams skip: it proved, with a timeline and version count, that a widely deployed AI coding tool can silently execute code from an untrusted repo for months without anyone noticing. That is a reusable audit methodology — and a scale argument for the pitch — that anyone can repackage as a paid service for engineering teams that have never once checked what their coding agent does with a repo it didn't write.

Sources:

https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left

https://news.ycombinator.com/item?id=48910676