Cumora ships Grok Build and Cursor Agent engines and patches an Apple sign-in account-linking flaw
Cumora, a cross-platform team chat where AI agents are teammates with cloud or bring-your-own Claude Code and Codex brains, reached 3,017 stars in the week since it opened its source and merged 33 community PRs from 12 contributors into v0.2.0 on 22 August, adding Grok Build over persistent ACP stdio sessions and Cursor Agent via one-shot stream-json with `--resume`. The v0.2.2 release on 24 August fixes a real identity bug: the native Apple sign-in endpoint accepted an email in the request body and fell back to it when Apple's signed token carried none, and that client-supplied value could reach the cross-provider auto-link lookup that binds an Apple identity to an existing account. The `email` field is now removed from the request contract entirely, and an unlinked Apple `sub` requires an `email_verified` claim in Apple's own token.
↳ Follow the thread