What happened
GitHub Security Advisories and NVD published CVE-2026-73217 (CVSS 7.7) and CVE-2026-73218 (CVSS 7.7) describing two distinct sandbox-escape techniques for Cursor's Auto-Run Sandbox, allowing an AI coding agent to break out of its intended containment and execute code on the host.
Why it matters
Cursor is one of the most widely deployed AI coding assistants; a sandbox escape means an agent (potentially manipulated via prompt injection from untrusted repo content) can escape its intended isolation and achieve arbitrary code execution on the developer's host machine — directly relevant to the agent-execution attack class this digest prioritizes.
Attack vector
An AI agent running in Auto-Run Sandbox mode replaces a Python virtual environment's executable with a malicious wrapper invoked outside the sandbox by the Microsoft Python extension (CVE-2026-73217); a related flaw (CVE-2026-73218) lets a sandboxed agent, when Docker Desktop and Dev Containers CLI are present, launch a privileged container and mount Docker's virtiofs0, gaining host filesystem read/write.
Affected systems
Cursor IDE for macOS, prior to 3.1.2 (CVE-2026-73217) and prior to 3.0.0 (CVE-2026-73218)
Mitigation
Upgrade Cursor to >= 3.1.2 (and >= 3.0.0 for the Docker-mount variant); review GitHub Security Advisories GHSA-p9g2-cr55-cw9c and GHSA-v4xv-rqh3-w9mc.