A critical one-click remote code execution (RCE) vulnerability recently exposed an estimated 50 million software developers using popular coding environments Cursor, Microsoft VS Code, and Google Antigravity to severe cyberattack risks. The flaw allowed attackers to silently compromise systems with just a single click on a malicious link. Security firm AISLE uncovered the widespread vulnerability, which has since been patched across all affected platforms.[cybersecuritynews+1]
Covert Attack Mechanism Uncovered
The vulnerability hinged on a deceptively simple yet highly effective attack method. Attackers could embed a malicious link directly within a Git commit message. When a developer clicked this link inside their code editor, the application would execute arbitrary code with full terminal privileges. Crucially, no confirmation dialog, warning prompt, or any visible indication of the malicious activity appeared for the victim.[cybersecuritynews+1]
This covert execution meant victims had no immediate way to detect the compromise in real-time. Once triggered, the vulnerability granted attackers the same level of access a developer holds on their own machine. This deep access allowed for various malicious activities, including the exfiltration of sensitive credentials and the installation of persistent malware.[cybersecuritynews+1]
Widespread Impact on Developers
The consequences for affected developers were severe. Attackers could steal sensitive API keys, such as those for OpenAI, Anthropic, and Stripe, directly from the local environment. They could also install persistent malware, like keyloggers, which broadcast every keystroke to an external server. Furthermore, the vulnerability enabled attackers to freely crawl or delete files across the local file system.[cybersecuritynews+1]
Because the malicious code persisted even after the code editor was closed, a single careless click could result in long-term, undetected surveillance of a developer's entire workflow. This posed a significant threat to intellectual property, corporate secrets, and personal data for millions of developers worldwide.[cybersecuritynews+1]
Shared Code, Shared Risk
AISLE's research team first identified this critical flaw in VS Code during automated vulnerability scanning in the fall of 2025. Because Cursor is built directly on top of the VS Code codebase, it inherited the same underlying weakness, making both popular AI-assisted coding environments simultaneously vulnerable. The issue then resurfaced in early 2026 within Google Antigravity, Google's newly launched AI-assisted coding environment, which also derives from the VS Code architecture.[cybersecuritynews+1]
This propagation across different platforms highlights a growing concern in the software development ecosystem: vulnerabilities in foundational components can quickly spread to other tools built upon them. This is especially true for AI-native developer tooling, where rapid iteration and reliance on shared frameworks can accelerate the spread of security flaws.[cybersecuritynews+1]
Swift Patches and Ongoing Vigilance
AISLE responsibly disclosed the issue to both Microsoft and Cursor immediately after its AI system flagged the bug. Google also received a prompt report when the vulnerability appeared in Antigravity. Google and Cursor moved quickly to patch the flaw, while Microsoft's fix for VS Code arrived somewhat later. As of now, current versions of Cursor, VS Code, and Google Antigravity no longer contain this specific vulnerability.[cybersecuritynews+1]
Developers are urged to ensure their code editors are updated to the latest versions to protect against this and other patched flaws. Regular software updates are a critical defense against evolving cyber threats, especially in the fast-paced world of software development.[aisle]
Beyond the 1-Click: Other Threats to AI Coding Tools
The 1-Click RCE via Git commit messages is not the only vulnerability that has recently affected these advanced coding platforms. Google Antigravity, for instance, also faced a critical RCE flaw related to prompt injection. Researchers at Pillar Security uncovered a weakness in Antigravity's tool-execution model, allowing attackers to escalate a seemingly benign prompt injection into a full system compromise. This flaw bypassed Antigravity's Secure Mode, its most restrictive security configuration, by exploiting how the IDE handled internal tool calls, particularly a file-search capability.Google patched this issue in late February 2026.[darkreading+3]
Cursor has also seen other significant RCE vulnerabilities. Mindgard, an offensive security firm, detailed a flaw where Cursor could automatically execute a malicious `git.exe` file if planted in a repository's root directory. This allowed for arbitrary code execution with no user interaction or warning when a developer opened the project.Additionally, Cato Networks reported "DuneSlide" vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor. These flaws leveraged prompt injection to escape the IDE's sandbox and achieve OS-level remote code execution, abusing automatic terminal command execution and incorrect handling of symbolic links.Cursor released patches for these in version 3.0 in April 2026.[darkreading+4]
These multiple discoveries underscore the inherent risks in increasingly complex and AI-driven development environments. Experts emphasize the importance of sandboxing AI agents, validating and sanitizing all inputs, and continuously monitoring for suspicious patterns. The integration of AI into coding tools brings powerful benefits but also introduces new attack surfaces that require constant vigilance from both developers and security researchers.[blog]
The rapid discovery and remediation of these critical RCE flaws highlight the ongoing battle to secure the software supply chain. As developer tools become more sophisticated, maintaining robust security practices and staying informed about the latest vulnerabilities remains paramount for protecting millions of developers and their work.
