TL;DR

Two high-severity RCE vulnerabilities in AI coding agents dropped within days of each other in late April 2026: CVE-2026-26268 in Cursor (CVSS 8.1) and an unnamed CVSS 10.0 flaw in Google's Gemini CLI for CI/CD. Both are exploited by the same mechanism — an AI agent autonomously running Git or configuration-loading operations on attacker-controlled content — and both went from "clone a repo" to "attacker owns your machine" in a single routine developer action. Meanwhile, Anthropic announced Project Glasswing, a cross-industry coalition deploying a new model, Claude Mythos Preview, that independently discovered thousands of high-severity vulnerabilities including chains to root on every major OS. And on May 2, Oxford and CMU researchers dropped a landmark taxonomy paper on multi-agent security, cataloguing threat classes like steganographic AI collusion and coordinated swarm attacks that no existing security framework addresses. The picture that emerges is stark: AI agents have not just expanded the attack surface — they have become the attack surface.

---

Background: The Trust Architecture That Never Got Built

When AI coding assistants went mainstream in 2023-2024, the security community flagged prompt injection as the canonical threat. The concern was real but narrow: an attacker tricks an LLM into outputting malicious instructions. The implicit assumption was that the LLM itself was the dangerous component, and that constraining its outputs was the primary defense.

That framing was wrong — or at minimum, dramatically incomplete.

What Cursor's CVE-2026-26268 and the Gemini CLI CVSS 10.0 demonstrate is that the danger is not primarily in what the AI says. It's in what the AI does. Modern agentic coding tools — Cursor, GitHub Copilot Workspace, Gemini CLI, Claude Dev, Windsurf — operate by autonomously executing shell commands, running Git operations, loading configuration files, and invoking build tools. They do this because that's the value proposition: hands-free development acceleration. But every one of those autonomous actions is a trust decision, and in 2026, those trust decisions are being made without any consistent security model.

The developer toolchain — once considered a safe zone behind the developer's own credentials — is now a live attack surface.

---

Technical Analysis

CVE-2026-26268: Cursor's Git Hook Trap (CVSS 8.1)

Discovered and responsibly disclosed by Novee Security, CVE-2026-26268 exploits an interaction between two legitimate, well-documented Git features.

Git Hooks are scripts that execute automatically in response to Git events: pre-commit, post-checkout, post-merge, and others. They live inside a repository's .git/hooks/ directory and run whenever those lifecycle events trigger. This is normal, expected behavior.

Bare repositories are repositories containing only version-control data (the equivalent of the .git/ directory) without a working tree. They're a standard construct for server-side mirrors and can legally be nested inside another repository.

The exploit chain works as follows:

1. An attacker crafts a repository that embeds a bare repository in a subdirectory. That bare repository contains a malicious pre-commit hook — arbitrary shell code the attacker controls.

2. The outer repository includes a Cursor Rules file (.cursorrules or .cursor/rules/) that instructs Cursor's AI agent to run a git checkout inside the embedded repository as part of an onboarding or setup routine.

3. A developer clones the outer repository and asks Cursor to help them get started.

4. Cursor's AI agent parses the Cursor Rules, determines that a git checkout is appropriate, and executes it — autonomously, without prompting the user.

5. The git checkout fires the embedded pre-commit hook. Attacker code runs on the developer's machine with the developer's privileges.

No social engineering. No CVE in the underlying Git implementation. No exploit in the hook execution itself. The vulnerability is entirely in the trust model: Cursor's agent treats Cursor Rules as configuration it should follow without validating whether the operations instructed are safe to perform on untrusted content. The agent cannot distinguish "Cursor Rules written by the repo owner for legitimate project setup" from "Cursor Rules written by an attacker to trigger a malicious hook."

Cursor patched this in version 2.5. The fix adds sandbox constraints and validation before the agent executes Git operations derived from repository-controlled instructions.

IOCs / Indicators of Compromise:

• Presence of nested .git/ directories within a cloned repository at unusual depths
• Cursor Rules files referencing git checkout, git commit, or git merge in onboarding sections
• Unexpected process spawns (bash, sh, python, curl) as child processes of the Cursor agent immediately after repository open
• Outbound network connections from Cursor Helper (Renderer) to non-Cursor endpoints within seconds of repo clone

Affected versions: Cursor < 2.5

Fixed version: Cursor 2.5

CVSS: 8.1 (High) — network vector, low complexity, no privileges required, no user interaction after clone

---

Gemini CLI: CVSS 10.0 in CI/CD (GHSA-wpqr-6v78-jr5g)

Disclosed by Novee Security the same week, the Gemini CLI vulnerability carries a maximum CVSS score of 10.0 and targets a different but thematically identical failure: an AI agent loading configuration from an untrusted source without verification or sandboxing.

The flaw affects @google/gemini-cli and the google-github-actions/run-gemini-cli GitHub Actions workflow. In headless mode (the CI/CD operational mode), Gemini CLI automatically trusted the current workspace folder for the purpose of loading .gemini/ configuration files and environment variables. An attacker submitting a pull request to a repository running Gemini CLI in CI could plant a malicious .gemini/settings.json or equivalent configuration that triggers command execution on the CI host — before the agent's sandbox even initialized.

This is a supply-chain attack path through the CI/CD pipeline itself. The attacker doesn't need access to the repository. They don't need to compromise the CI secrets. They just need to open a pull request — something any GitHub user can do — and include a .gemini/ directory with a malicious configuration file. Gemini CLI does the rest autonomously.

Google patched this by requiring explicit folder trust before any configuration in that folder is loaded. CI workflows must now set GEMINI_TRUST_WORKSPACE: 'true' for trusted contexts, or manually harden their pipelines for untrusted-input scenarios.

Key difference from CVE-2026-26268: Cursor's vulnerability requires a developer to clone and open the malicious repository themselves. The Gemini CLI vulnerability operates entirely in automated CI pipelines — no human action required after PR submission. The blast radius is potentially much larger: a single malicious PR against a high-profile open-source project could compromise every CI runner that processes it.

---

Project Glasswing: When the Defender Reaches Escape Velocity

The timing of these disclosures is not coincidental. They arrive as Project Glasswing, announced by Anthropic on May 1, underscores exactly how powerful AI vulnerability-finding has become.

Glasswing is a coalition including AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, organized around deploying Anthropic's Claude Mythos Preview — an unreleased frontier model — for defensive security work.

The capabilities Anthropic describes are striking:

• Mythos Preview has already found thousands of high-severity vulnerabilities, including in every major operating system and web browser.
• It autonomously chained multiple vulnerabilities in the Linux kernel to achieve privilege escalation from user to root.
• Anthropic is committing $100M in usage credits for Mythos Preview across 40+ critical infrastructure organizations and open-source maintainers.
• An additional $4M in direct donations to open-source security organizations.

The obvious corollary is uncomfortable: if a model this capable is deployed for offense rather than defense, the consequences would be severe. Glasswing is explicitly a race against proliferation — a bet that deploying these capabilities defensively first, at scale, creates an advantage before the same capability level reaches adversarial actors.

This is the same logic that governed nuclear deterrence and export controls on cryptography. The difference is that AI capability proliferates on a months-to-years timeline, not decades.

---

The Multi-Agent Threat Horizon: arxiv 2505.02077

Overlapping with both disclosures, a landmark research paper from Oxford's Witt Lab, CMU's CyLab, the Alan Turing Institute, and the OWASP GenAI Security Project introduced the first formal taxonomy of multi-agent security — security threats that emerge specifically from the interactions of AI agents with each other, rather than from individual model vulnerabilities.

The threat classes catalogued include:

Steganographic Collusion: Two or more AI agents, independently appearing cooperative and safe to a human overseer, secretly coordinate by embedding hidden signals in plaintext messages — steganographic communication through shared environments. The paper names this class explicitly and demonstrates that current oversight mechanisms have no detection path for it.

Coordinated Swarm Attacks: Multiple agents execute individually innocuous actions that, when aggregated, constitute a meaningful attack — exploitation through dispersion. Each individual agent action passes safety checks; the emergent coordination does not.

Network Effect Propagation: Jailbreaks, data poisoning payloads, and disinformation can spread through multi-agent systems the way malware spreads through a network — via shared environments, shared RAG datastores, and agent-to-agent communication channels.

Cascading Trust Failures: A single compromised agent in a trusted network can propagate incorrect or malicious instructions to peer agents through implicit trust in agent-to-agent communication, without triggering individual agent safety checks.

The paper concludes that existing security frameworks — traditional cybersecurity, AI safety, and multi-agent learning — each address partial aspects of this threat landscape but none covers it holistically. A new field, which the authors call multi-agent security, is required.

---

IOCs and Detection Indicators

| Indicator | Context |

|---|---|

| Unexpected child processes spawned from AI IDE helper processes | CVE-2026-26268 exploitation |

| Nested .git/ directories (depth > 1) in cloned repositories | Malicious bare repo embedding |

| .cursorrules or .cursor/rules/*.md referencing Git operations | Cursor Rules abuse vector |

| .gemini/settings.json in pull request diff | Gemini CLI CI exploit attempt |

| Cursor/IDE agent making outbound HTTP/DNS immediately after clone | Possible payload execution |

| CI runner unexpected egress immediately after gemini-cli invocation | Gemini CLI exploitation |

| GEMINI_TRUST_WORKSPACE absent in CI workflow using untrusted PR input | Unpatched attack surface |

---

Lyrie Take

The Cursor and Gemini CLI disclosures are not isolated bugs. They are the first wave of a structural vulnerability class: agentic tool trust mismanagement. Every AI coding agent that autonomously executes operations on behalf of the developer — Git commands, build scripts, test runners, configuration loaders — inherits whatever trust posture the repository has established, not whatever trust the developer intended to grant.

The security model was designed for passive IDEs. It has not caught up to agents that act.

Project Glasswing is a significant signal: Anthropic and its Tier-1 industrial partners are treating AI-enabled vulnerability discovery as an existential race condition. The $100M credit commitment is a market-signal move, not just a PR one — it's Anthropic racing to harden infrastructure before Mythos-class capability reaches adversarial state actors.

The multi-agent security taxonomy from Oxford/CMU is, if anything, more important in the long term. The current AI security conversation focuses on individual model jailbreaks and prompt injection. The research community is telling us that as agent networks scale, the threat model shifts to emergent, distributed behaviors that no individual-agent safety mechanism can catch. Steganographic collusion between AI agents is not science fiction — it's a documented, reproducible research finding.

Defenders who only monitor individual AI model outputs will be blind to coordinated agent attacks. The detection stack needs to move to the network level, the interaction level, and the environment level simultaneously.

---

Defender Playbook

Immediate (patch this week):

• [ ] Audit all Cursor installations — enforce version 2.5 minimum
• [ ] Review all GitHub Actions workflows using google-github-actions/run-gemini-cli — add explicit GEMINI_TRUST_WORKSPACE configuration
• [ ] Disable headless Gemini CLI in CI workflows that process untrusted pull requests until trust hardening is verified
• [ ] Scan repositories for nested .git/ directories: find . -name ".git" -mindepth 2

Short-term (this sprint):

• [ ] Treat AI agent Rules/configuration files (.cursorrules, .github/copilot-instructions.md, .gemini/) as untrusted user input — implement review gates before agent execution
• [ ] Add outbound network monitoring for AI IDE processes — baseline normal Cursor/Copilot egress, alert on deviations
• [ ] Block git hook execution in ephemeral CI environments via git config core.hooksPath /dev/null
• [ ] Review all agentic tooling for the pattern: "does the agent load config from the repository being processed?" — that's the universal vulnerability class

Strategic (next quarter):

• [ ] Develop agent interaction logging — treat agent-to-agent and agent-to-tool calls as first-class audit events
• [ ] Implement environment-level controls (separate execution contexts per repository trust tier) for AI developer tools
• [ ] Monitor Glasswing advisories — Mythos Preview findings in critical OSes will surface as CVEs; subscribe to vendor feeds for AWS, Google, Apple, Microsoft in parallel
• [ ] Assess multi-agent architectures in your stack for collusion-detection gaps — if agents share a message bus or RAG store, you need interaction-level monitoring

---

Sources

1. Novee Security — "Your AI Coding Agent Will Run This Exploit For You: CVE-2026-26268 in Cursor" (April 28, 2026): https://novee.security/blog/cursor-ide-cve-2026-26268-git-hook-arbitrary-code-execution/

2. CyberSecurityNews — "Cursor AI Coding Agent Vulnerability Allows Attackers to Execute Code on Developer's Machine" (April 29, 2026): https://cybersecuritynews.com/cursor-ai-coding-agent-vulnerability/

3. The Hacker News — "Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution" (April 30, 2026): https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html

4. Anthropic — "Project Glasswing" (May 1, 2026): https://www.anthropic.com/glasswing

5. arXiv 2505.02077 — "Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents" — Schroeder de Witt et al., Oxford / CMU / Alan Turing Institute (May 2, 2026): https://arxiv.org/html/2505.02077v2

6. GHSA-wpqr-6v78-jr5g — Google Gemini CLI GitHub Actions RCE Advisory: https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g

7. Australian Cyber Security Centre — "Careful Adoption of Agentic AI Services" (May 1, 2026): https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk