Cursor is the AI-native IDE everyone codes in now — a VS Code fork with agents that edit, index and run your project. 7M+ users, 1M+ paying, $60B valuation. Mindgard’s Aaron Portnoy found that on Windows, when Cursor opens a project it goes hunting for a Git binary across several paths, and one of them is the workspace root.
So: clone a repo, open it in Cursor, and the git.exe sitting in that repo’s root executes. No click. No prompt. No warning. And it fires again on a cadence. His proof of concept was Calculator, renamed.
Seven months of nothing
Reported December 15, 2025. HackerOne marked it out-of-scope, then reopened it in January. February through June: every follow-up ignored. 197+ Cursor releases shipped, still exploitable as of 3.2.16. On July 14 Portnoy published everything, because a fix that never comes isn’t a fix.
Why this one stings
HN’s counter (142 points of arguing) is that Windows already puts the working directory on PATH — a platform quirk, not a Cursor bug. Except VS Code resolves git from known system locations. The patch is trivial. That’s what makes the silence the story.
The AI angle isn’t the exploit, it’s the blast radius: AI coding tools made “clone a stranger’s repo and let the agent look at it” a normal Tuesday. Every one of those repos is now an executable.
You Might Also Like
- Karpathy Built a Full Chatgpt Clone in 8000 Lines of Code Nanochat Hits 47k Stars
- Freestyle Gives ai Coding Agents a Full Linux vm in 700ms and can Clone it While its Still Running
- Kani tts 2 Just Dropped and it Only Needs 3gb of Vram to Clone Your Voice
- Google Workspace Studio Just Made ai Agents a Thing Everyone can Build
- Windsurf Wave 13 Just Dethroned Cursor Heres why Developers are Paying Attention
Top AI Product 
Leave a comment