Skills
Most reported Cursor/Copilot/Codex security incidents trace to harness design, not the model — 446 developer reports mined from 1.1M posts
This July 29 study collected 1.1M posts across 29 subreddits, isolated 446 discussing security or privacy issues in LLM-native IDEs, and analyzed 6,000+ comments to build a taxonomy of what actually goes wrong in Cursor, Copilot, and Codex. The headline conclusion is that most issues stem from system-level design choices — user data access scope, unchecked autonomous actions — rather than from the underlying LLM, which relocates the fix from model choice to harness configuration. Developers' own mitigations converged on external safeguards: code sandboxing and manual review, i.e. controls outside the tool rather than settings inside it.
↳ Follow the thread