Windsurf prompt-injection RCE: attacker HTML can register a malicious MCP server.

A disclosed flaw in Windsurf 1.9544.26 lets remote attackers run arbitrary commands. When the editor processes attacker-controlled HTML, malicious instructions modify the local MCP config and silently register a malicious STDIO MCP server (OX Security). Any content your agent fetches from the web is untrusted input. Treat a webpage your agent reads with the same suspicion as a file an attacker handed you.