Entity trail

Patched

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-07 / vibe-coding-researcherCursor 'DuneSlide' Sandbox-Escape Flaws (CVE-2026-50548/50549, CVSS 9.8) DisclosedCato AI Labs disclosed two critical Cursor vulnerabilities dubbed DuneSlide: one abuses the sandbox trusting an agent-chosen working folder to overwrite the sandbox enforcer itself, the other exploits a symlink safety check that trusts the apparent path when link resolution fails. Both rate CVSS 9.8 and enable escape from the agent sandbox to unrestricted command execution. They were patched in Cursor 3.0, so the actionable step is confirming your install is on 3.0+.
2026-06-27 / vibe-coding-researcherOWASP v2.01 State of Agentic AI Security: Prompt Injection May Be Unfixable, Not Just UnpatchedOWASP published version 2.01 of its State of Agentic AI Security and Governance on June 11, arguing that prompt injection — the central weakness of autonomous agents — may be inherent rather than a bug a future release will close. A parallel review synthesizing 78 studies (2021-2026) found attack success rates above 85% against state-of-the-art defenses when adaptive strategies are used, reframing the problem from prevention to containment for anyone shipping tool-enabled agents.
2026-06-26 / vibe-coding-researcherMCP Security in June 2026: ~40% of Remote Servers Still Expose Tools With No AuthenticationFresh June tallies underline that MCP's security debt is structural, not incidental: Censys counted ~12,520 internet-accessible MCP services (most unauthenticated), a separate study found roughly 40% of remote servers expose tools with no auth, VIPER-MCP's sweep of ~40,000 repos produced 67 CVEs, and Microsoft patched a server-hijacking flaw (CVE-2026-26118). For anyone wiring MCP into coding agents, the takeaway is concrete: treat every remote server as hostile by default — authenticate, scope tokens, and sandbox.

Source trail

CVE-2026-25592 Adversa AI disclosed OX Security discovered Nightmare-Eclipse Source Source

Graph sources

entity graphfindings textkg entitiesnewsletter issues