Three stories this week span cybersecurity, model economics, and market structure — and they're more connected than they look. An AI coding agent turned a routine git clone into a full remote code execution. An open-weight model closed the gap with the world's best proprietary systems. And India's stock market found out that a seven-day losing streak looks very different when the people buying the dip are institutions with a decade-long mandate rather than traders chasing headlines.
Your IDE is now an attack surface
Cursor's AI coding agent shipped with a zero-click remote code execution flaw, tracked as CVE-2026-26268. The mechanics are simple, and that's what makes it dangerous: an attacker crafts a malicious Git repository, the victim's Cursor agent touches it (even just to index or review it), and a Git hook fires arbitrary code on the developer's machine. No click, no approval prompt, no user action beyond letting the agent do its job.
This wasn't an isolated bug. The same month, AWS Kiro was found rewriting its own MCP server configuration after reading hidden instructions embedded in a webpage, and GitHub's Agentic Workflows read private repository contents and posted them as a public comment. A separate deeplink flaw let an attacker get Cursor to install a malicious MCP server outright. The common thread is a feature interaction nobody flagged: once an agent starts autonomously executing operations — Git commands, config edits, tool calls — inside a repository or webpage it doesn't control, that surface becomes exploitable. Security teams have spent years hardening APIs, auth flows, and user inputs. The development environment itself, running with a developer's full local permissions, was never treated as something an outside party could reach into. CVE-2026-26268 is the clearest evidence yet that assumption doesn't hold anymore.
