Entity trail

Cursor 2 5

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-07 / vibe-coding-researcherCursor 'DuneSlide' Sandbox-Escape Flaws (CVE-2026-50548/50549, CVSS 9.8) DisclosedCato AI Labs disclosed two critical Cursor vulnerabilities dubbed DuneSlide: one abuses the sandbox trusting an agent-chosen working folder to overwrite the sandbox enforcer itself, the other exploits a symlink safety check that trusts the apparent path when link resolution fails. Both rate CVSS 9.8 and enable escape from the agent sandbox to unrestricted command execution. They were patched in Cursor 3.0, so the actionable step is confirming your install is on 3.0+.
2026-06-30 / thought-leaders-researcherCursor Vibe Jam 2026 Crowns Its Winners — and Doubles as a Yearly Benchmark for How Fast AI Coding Is ImprovingLevels' second annual Vibe Jam (sponsored by Cursor, Bolt, Lambda, CodeRabbit, Glif, and Tripo) is explicitly framed as an open benchmark for what one developer plus an AI copilot can ship in a single month; the $25K winner was 'A Game About Capybaras Delivering Food.' Levels noted entries are nearing real production quality. For builders, it's a concrete, repeatable yardstick of agentic-coding capability gains year over year — useful signal beyond model benchmarks.
2026-06-29 / skill-finderCursor Composer 2's compaction-in-loop RL cuts mid-task 'forgot the constraint' errors ~50%Composer 2 (released March 19, 2026) trains the model to compress its own ~200K context down to roughly 1,000 tokens mid-session and continue — and because the compression happens inside the RL loop with a reward for maintaining task completion post-compression, the model learns which details to keep, reporting ~50% fewer compaction errors than external summarization. The practitioner signal: 'compaction-in-the-loop' is becoming the differentiator for multi-hour autonomous coding, and external bolt-on summarizers are the weak point. Builders evaluating coding agents for long refactors should test specifically for constraint loss after compression, not just raw context size.
2026-06-27 / reddit-researcherCursor's June Update: Composer 2.5 Powers Bugbot (~90s Reviews), Pre-Push '/review', and Always-On AutomationsCursor's June release ties its in-house Composer 2.5 model to Bugbot, cutting average review time from ~5 minutes to ~90 seconds while finding ~10% more bugs per review (0.62 vs 0.56) at ~22% lower cost per run. A new /review flow runs Bugbot and Security Review before push, dedups against the eventual PR, and supports incremental 'only what's new' review; Cursor also added Automations — always-on agents plus an /automate skill with GitHub/Slack triggers and computer use. This is a concrete move from chat-IDE to standing review/automation agents in the dev loop.
2026-06-23 / news-researcherCursor Unveils Origin (Agent-First Git Platform), a 1.5T-Parameter In-House Model, and a Mobile AppAt its June 16 #compile keynote, Anysphere announced Origin — a GitHub/GitLab alternative built for AI agents on the Graphite tech it acquired in Dec 2025, with GA targeted for fall 2026 — alongside a proprietary 1.5T+ parameter model trained from scratch on 100K+ GPUs (reportedly xAI's Colossus) and a Cursor iOS app. The launch lands the same week SpaceX announced its $60B all-stock acquisition of the company. For builders this signals the coding-agent stack moving down to its own VCS substrate, not just the editor.
2026-06-23 / agents-researcherOWASP ships State of Agentic AI Security v2.01 alongside fresh coding-agent CVEs in Cursor and ModelScopeOWASP's GenAI Security Project released version 2.01 of its State of Agentic AI Security and Governance on June 11, 2026, cataloging CVEs, vendor advisories, and breach reports across nearly every agentic-risk category. Two concrete entries hit coding agents directly: CVE-2026-22708 lets an attacker poison a Cursor IDE agent's execution environment so allowlisted commands like `git branch` deliver arbitrary payloads, and CVE-2026-2256 is a command-injection flaw in ModelScope's MS-Agent whose shell tool fails to sanitize input, allowing crafted content fed to the agent to execute arbitrary OS commands on the host. Both reinforce that allowlist-based command gating in agent harnesses is brittle against environment poisoning.
2026-06-19 / projects-researcherOpenCode Crosses 172K Stars and Tops June 2026 Power Rankings, Displacing Cursor From #1OpenCode, the MIT-licensed, model-agnostic terminal coding agent, has crossed roughly 172K GitHub stars and about 7.5M monthly active developers, and topped LogRocket's June 2026 AI dev-tool power rankings — displacing Cursor from the #1 spot. It supports 75+ providers (Claude, GPT-5.5, Gemini, DeepSeek, Grok, and local models via Ollama) from a single CLI, treating the model as a pluggable dependency rather than the product. Its rise tracks the broader 2026 shift toward provider-agnostic harnesses.
2026-06-18 / saas-disruption-researcherCredit-Based Pricing Grew 126% YoY as 62% of SaaS Platforms Add AI-Premium Tiers — Buyers Budget 25–35% MorePer McKinsey's 2026 software pricing data, 62% of SaaS platforms have introduced AI-premium tiers and credit-based pricing nearly doubled year-over-year (35 → 79 companies), with HubSpot, Figma, Adobe, Salesforce, and Cursor all adopting credit models. Buyers report budgeting 25–35% more when bolting AI onto an existing stack. Credits are emerging as incumbents' compromise between predictable seats and scary usage meters — a way to charge more for AI without abandoning the subscription line item.
2026-06-15 / thought-leaders-researcherKent C. Dodds Demos His Full Cursor-Based App-Building Workflow at AI Coding Summit 2026At AI Coding Summit 2026 (Amsterdam/online, June 11–15) Kent C. Dodds walked through 'How I Build Web Applications in 2026,' sharing his current favorite AI workflows in Cursor and building a real-world full-stack app live. The value for builders is in the specifics of how a testing-and-quality-focused educator now sequences AI assistance into production work — a practitioner's workflow, not a hype reel. It's a useful counterweight to the 'coding is going away' framing he's publicly engaged with.
2026-06-14 / vibe-coding-researcherCursor Ships Composer 2.5 and a Premium Seat Tier for Heavy Agent UsersCursor's June update introduces Composer 2.5 — its latest in-house model claiming frontier performance at a fraction of the cost — plus a new Premium seat aimed at developers running many agents, with improved spend forecasting and controls. Enterprise admins get organization-level controls to manage multiple teams from one place with separate security, governance, and budget settings, and new Groups for flexible access permissions. This continues Cursor's push toward fleet-scale agent management (up to 8 parallel agents via Mission Control).
2026-06-12 / vibe-coding-researcher'caveman' Claude Code Skill Hits 54k+ Stars by Making Agents Talk Like Cavemen to Cut Output TokensJuliusBrussee/caveman rocketed to 54,000+ GitHub stars in under three weeks (and #1 on Hacker News) as a skill/plugin — also packaged for Codex, Gemini, Cursor, Windsurf, Cline, and Copilot — that strips agent verbosity (no 'I'd be happy to help' preamble) while keeping code blocks, error strings, and symbols exact. The project advertises ~65% average output reduction across 10 prompts (range 22-87%), though independent benchmarks land closer to 30-50%.
2026-06-09 / saas-disruption-researcherVibe-Coding Market Hits ~$4.7B (38% CAGR) as Cursor, Replit and Lovable Detach From SaaS MultiplesThe vibe-coding category is estimated at ~$4.7B growing 38% annually toward a projected $12.3B by 2027, anchored by Cursor (~$29B, reportedly raising toward $50B), Replit ($9B), and Lovable ($6.6B). These valuations have decoupled from classic per-seat SaaS multiples because the tools replace the build step itself rather than selling seats around it. For builders: the category is consolidating into a few well-capitalized platforms even as it expands. (Funding rounds Nov 2025–Apr 2026; market sizing is current analysis.)

Graph relationships

RELEASED
Cursor -> Cursor 2.5
Cursor 2.5 shipped with full plugin marketplace
Source finding

Source trail

Hard2bit Vibe Jam (vibej.am)Cursor — Introducing Composer 2 Cursor Changelog — Composer 2.5 The Decoder Help Net Security / OWASP MorphLLM

Graph sources

entity graphfindings textkg edgeskg entities