A critical vulnerability in the Cursor IDE platform allows malicious code to auto-execute when a user opens a poisoned repository, posing a significant threat to developers. Despite being reported to the vendor in December, the issue remains unpatched, leaving users exposed to potential attacks. The vulnerability can be exploited by attackers who inject malicious code into public repositories, which is then executed when a user opens the repository in the Cursor IDE. This raises concerns about the security of AI-powered coding platforms and the need for vendors to prioritize prompt patching of reported vulnerabilities1. The fact that this vulnerability remains unaddressed highlights the importance of ongoing monitoring and verification of dependencies in the development workflow. So what matters to practitioners is that unaddressed vulnerabilities like this can turn trusted development tools into attack vectors, underscoring the need for vigilance in securing the software supply chain.