Cursor AI editor lets repos “autorun” malicious code on devices

This vulnerability enables threat actors to execute arbitrary code, steal credentials and API tokens, modify files, or establish command-and-control channels without any user interaction.