TL;DR

This week delivered a synchronized indictment of agentic security assumptions: CVE-2026-26268 in Cursor IDE (CVSS 9.9, patched 2.5) enables a malicious Git repository to achieve RCE on a developer's machine through autonomous agent hook execution. CVE-2026-5752 in Cohere's Terrarium sandbox (CVSS 9.3) escapes an AI code execution container via JavaScript prototype chain traversal to root on the Node.js host. CVE-2026-22708, an earlier Cursor/Antigravity prompt injection flaw, confirmed the pattern repeats across agentic IDEs. Simultaneously, Google and Forcepoint researchers documented at least 10 live indirect prompt injection (IPI) payloads operating in the wild — targeting financial fraud, data destruction, and API key exfiltration. The connecting thesis: AI agents have surgically removed the human action requirement from attack chains that security models have relied upon for a decade.

---

Background: The Perimeter That Was Never There

Developer workstations have always been attractive targets. In 2022, the Lazarus Group's macOS tooling specifically hunted engineering machines to pivot from dev credentials to production infrastructure. In 2023, the 3CX supply chain compromise began on a developer's Electron app. In 2024, the xz-utils backdoor was a five-month social engineering campaign against a single maintainer.

The common thread across each of these was a human action requirement. Phishing, social engineering, convincing a developer to run a script, click a link, open a file. Security awareness training, EDR behavioral signatures, and sandboxed execution all assumed that a human being would touch the keyboard at some critical moment — and that moment was where defenders focused.

Agentic IDEs have quietly invalidated that assumption. Cursor, GitHub Copilot Workspace, Antigravity, Devin, and their peers now routinely execute shell commands, Git operations, file modifications, and network requests on behalf of developers — inferring intent from high-level natural language prompts and acting autonomously. The human moved up the abstraction stack. The attack surface did not.

---

CVE-2026-26268: When Git Hooks Become Weapons (Cursor, CVSS 9.9)

Researchers at Novee Security disclosed the most technically crisp of this week's vulnerabilities on April 28. The vulnerability chain is elegant in its simplicity and devastating in its implications.

The setup: An attacker crafts a repository containing a nested bare repository with a malicious pre-commit hook embedded. The repository's visible contents appear entirely legitimate — this is not a typosquatting attack or a social engineering play. It is a structurally valid Git project.

The trigger: A developer clones the repository and opens it in Cursor. The developer issues a high-level prompt: "Set up the project," "Check that everything is working," or simply navigates the codebase. Cursor's AI agent interprets this as authorization to perform standard development scaffolding — and that scaffolding includes Git operations.

The exploitation: When the agent performs a git checkout or similar operation, Git's own hook execution logic fires the attacker's pre-commit script. The agent never explicitly chose to run arbitrary code — it made what appeared to be a legitimate repository management decision. The hook executes with the developer's full system privileges.

The amplifier: NVD's description of the CVE notes that prior to version 2.5, a malicious agent could additionally "write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox RCE next time they are triggered." This means even passive repository browsing — before any Git operation — could be used by an injected prompt to poison the local hook configuration for later execution.

As Levkovich of Novee articulated it: "Security has long relied on trusted IDEs and human action as safeguards. AI agents remove both constraints."

Cursor contests NVD's 9.9 rating and issued a vendor CVSS of 8.0. Whatever scoring convention wins, the underlying capability — remote code execution on a developer machine through normal workflow without phishing or user error — is unambiguous. Patched in Cursor 2.5. Upgrade immediately.

---

CVE-2026-5752: Escaping the Sandbox at the JavaScript Layer (Cohere Terrarium, CVSS 9.3)

Cohere's open-source Terrarium project occupies a different threat model but illuminates the same architectural vulnerability class. Terrarium is a Docker-deployed Python sandbox designed to safely execute untrusted code — specifically code written by or generated with assistance from LLMs. It runs on Pyodide, a Python-to-WebAssembly runtime that executes inside Node.js.

The vulnerability, credited to researcher Jeremy Brown, is a JavaScript prototype chain traversal in the Pyodide WebAssembly environment. Pyodide bridges Python and JavaScript execution contexts — a design choice that enables standard Python package support but creates a boundary crossing that the sandbox fails to adequately isolate.

By manipulating JavaScript's __proto__ chain from within ostensibly sandboxed Python code, an attacker achieves arbitrary code execution on the host Node.js process — outside the container's intended restriction envelope. From there: read /etc/passwd, reach adjacent container-network services, and in assessed scenarios, escalate further out of the container entirely.

The real-world threat surface: Terrarium has 56 forks and 312 stars. More significantly, it represents a deployment pattern — LLM-adjacent code execution sandboxes — that has proliferated across inference providers, coding assistants, and notebook environments. Every such system that uses a language-boundary bridge (Python↔JavaScript, Python↔Wasm, Python↔gVisor) inherits a potential variant of this class of vulnerability. The specific prototype chain mechanism is Pyodide-specific; the architectural risk of assuming sandbox boundary fidelity across language runtimes is universal.

No authentication or user interaction is required to exploit CVE-2026-5752. An attacker with local access — which in cloud-hosted LLM inference infrastructure means any user submitting code to the platform — can achieve root execution on the host process.

---

The Indirect Prompt Injection Ecosystem Matures

The CVE disclosures this week exist in a wider context documented simultaneously by Google and Forcepoint researchers: indirect prompt injection is no longer proof-of-concept — it is a deployed attacker capability operating at scale.

Forcepoint's X-Labs team performed active threat hunting across publicly accessible web infrastructure, flagging payloads triggering on detection signatures including "Ignore previous instructions," "If you are an LLM," and "If you are a large language model." Google simultaneously analyzed a corpus of 2–3 billion crawled pages per month, examining static websites, blogs, forums, and comment sections.

What they found: Ten distinct live IPI payload classes, including:

• Financial fraud payloads — One example embedded a fully specified PayPal transaction with step-by-step execution instructions targeting AI agents with payment capabilities. A second used HTML meta-namespace injection combined with a "persuasion amplifier" keyword (ultrathink) to route AI-mediated financial actions to an attacker-controlled Stripe link.
• Destructive payloads — Prompts instructing LLM-powered coding assistants or shell-access agents to execute rm -rf / equivalents on the user's file system.
• Exfiltration payloads — Instructions designed to locate and transmit API keys from accessible environments, with covert return channels back to the attacker.
• DoS and traffic hijacking payloads — Instructions preventing AI agents from returning legitimate content, or redirecting agent-mediated search results.
• Reconnaissance payloads — Widely distributed test payloads likely functioning as capability probes to identify which deployed AI systems respond to injected instructions before deploying higher-impact attacks.

The steganographic techniques for hiding IPI payloads from human review while keeping them visible to AI are now standardized: single-pixel text, near-transparent color values, and standard HTML display: none or visibility: hidden attributes. The payloads are invisible to a human reviewer scanning a page; they are fully legible to an LLM parsing the DOM.

Forcepoint's assessment: "The impact scales with AI privilege. A browser AI that can only summarize is low-risk. An agentic AI that can send emails, execute terminal commands, or process payments becomes a high-impact target."

---

The Unified Threat Model

Cursor CVE-2026-26268, Cohere Terrarium CVE-2026-5752, Antigravity/Cursor CVE-2026-22708, and the IPI corpus are not isolated bugs. They are manifestations of the same architectural transition being exploited before the security community has adapted its threat models:

Classical attack chain: Attacker → deliver payload → human action (click, open, execute) → compromise

Agentic attack chain: Attacker → poison environment (repository, webpage, tool response) → agent action (autonomous, assumed-safe) → compromise

Traditional defenses — user awareness training, phishing simulation, execution policies requiring explicit user consent — all assumed and relied on step 3 being human-mediated. Agentic systems removed that gate without replacing it.

The developer workstation is particularly exposed because agentic IDEs operate at the highest privilege intersection: access to source code, credentials, SSH keys, cloud provider configurations, and the production infrastructure they connect to. RCE on a developer's Cursor session is not just workstation compromise — it is a launchpad for the entire stack the developer can touch.

---

Indicators of Compromise / Detection Signals

For CVE-2026-26268 (Cursor):

• Unusual process spawning from Cursor or git processes not initiated by direct user action
• .git/hooks/ directories in cloned repositories with executable scripts
• Nested bare repositories within project directories (git fsck --lost-found anomalies)
• Monitor for git checkout operations triggering child process execution

For CVE-2026-5752 (Cohere Terrarium):

• Node.js processes with unexpected root-privilege child processes
• File reads to /etc/passwd, /etc/shadow from Node.js or Pyodide processes
• Unexpected outbound network connections from Terrarium containers

For Indirect Prompt Injection:

• Web proxy/DLP rules flagging outbound requests containing ignore previous instructions in request parameters
• LLM output monitoring for anomalous action sequences not consistent with user intent
• Canary tokens in accessible credential files (detect exfiltration attempts)

---

Lyrie Verdict

Severity: Critical architectural risk, not just CVE risk

>

The individual CVEs here are all patched or patchable. The underlying threat is not. The 2026 developer toolchain assumes agent autonomy as a feature; adversaries are now systematically treating that autonomy as a vulnerability class. Every repository an agent touches, every webpage an agent summarizes, every tool call an agent makes is a potential injection vector.

>

Lyrie's autonomous detection architecture is specifically designed for this threat model — not waiting for human review of agent actions, but operating at machine speed to validate tool call sequences, detect anomalous agent behavior, and enforce principle-of-least-privilege on every autonomous action. The human was never going to be able to review 10,000 tool calls per day. That's not a training problem. It's an architectural one. Lyrie solves it at the layer where it lives.

>

Immediate actions required:

- Upgrade Cursor to 2.5+

- Audit Terrarium deployments and apply CVE-2026-5752 patches

- Implement agent output monitoring and action-intent validation on all LLM-backed tools

- Treat agentic IDE operations with the same skepticism as untrusted code execution

---

Defender Playbook

Tier 1 — Patch (24h):

1. Cursor → update to ≥ 2.5 via IDE auto-update or cursor --update

2. Cohere Terrarium deployments → apply patched container image; check CVE-2026-5752 status on vendor release page

Tier 2 — Harden Agent Permissions (72h):

3. Restrict agentic IDE process tokens: run Cursor/Copilot agents under a dedicated low-privilege OS user, not the developer's primary session

4. Mount project directories with noexec where feasible; restrict Git hook execution for cloned external repositories

5. For Terrarium/Pyodide deployments: deploy additional seccomp/AppArmor profiles restricting __proto__ manipulation at the V8 layer (vendor guidance pending)

Tier 3 — Detect Indirect Prompt Injection (1 week):

6. Deploy proxy-layer rules scanning LLM input/output for IPI trigger phrases

7. Add canary API keys and credentials in developer environments — alert on any access or transmission

8. Instrument agent action logs; flag action sequences that include file deletion, external network requests, or process spawning not traceable to explicit user prompts

9. Periodic git repository audits: find . -name ".git" -mindepth 2 to detect nested bare repository traps

---

Sources

1. CSO Online — "Critical Cursor bug could turn routine Git into RCE" (Apr 28, 2026): https://www.csoonline.com/article/4164250/critical-cursor-bug-could-turn-routine-git-into-rce.html

2. NVD — CVE-2026-26268 (Cursor, CVSS 9.9): https://nvd.nist.gov/vuln/detail/CVE-2026-26268

3. GitHub Security Advisory — GHSA-8pcm-8jpx-hv8r (Cursor): https://github.com/cursor/cursor/security/advisories/GHSA-8pcm-8jpx-hv8r

4. The Hacker News — "Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution, Container Escape" (Apr 22, 2026): https://thehackernews.com/2026/04/cohere-ai-terrarium-sandbox-flaw.html

5. CVE.org — CVE-2026-5752 (Terrarium, CVSS 9.3): https://www.cve.org/CVERecord?id=CVE-2026-5752

6. CERT/CC — VU#414811 (Terrarium Pyodide prototype chain): https://kb.cert.org/vuls/id/414811

7. Help Net Security — "Indirect prompt injection is taking hold in the wild" (Apr 24, 2026): https://www.helpnetsecurity.com/2026/04/24/indirect-prompt-injection-in-the-wild/

8. Infosecurity Magazine — "Researchers Uncover 10 In-the-Wild Indirect Prompt Injection Attacks" (Apr 23, 2026): https://www.infosecurity-magazine.com/news/researchers-10-wild-indirect/

9. Google Security Blog — "AI Threats in the Wild: Current State of Indirect Prompt Injection" (Apr 2026): https://security.googleblog.com/2026/04/ai-threats-in-wild-current-state-of.html

10. Dark Reading — "Google Fixes Critical RCE Flaw in AI-Based 'Antigravity' Tool" (Apr 2026): https://www.darkreading.com/vulnerabilities-threats/google-fixes-critical-rce-flaw-ai-based-antigravity-tool

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk