Cursor's Zero-Day, Kimi K3, and Codex's Sealed Audit Trails

Mindgard published full technical details on 14 July of an unpatched zero-day in Cursor IDE on Windows. On opening a project, Cursor searches several locations for a Git binary — including the workspace root — so a malicious file named git.exe in a repository's root executes automatically when the IDE runs `git rev-parse --show-toplevel`, with the user's privileges, no prompt, no interaction. The Hacker News puts it plainly: "Whatever that binary does, it does as you, with your source, your SSH keys and your cloud tokens." Execution repeats during normal IDE operation. The flaw is demonstrated only on Windows, and whether Cursor searches the workspace itself or Windows' executable search order finds the file first, the write-up does not say.

The detail: The timeline is Mindgard's account: reported to security-reports@cursor.com on 15 December 2025; a mid-January LinkedIn response from Cursor's CISO routing it into a private HackerOne programme, where it was closed as "Informative and out of scope", reopened after Mindgard challenged the closure, and confirmed delivered on 20 January; status requests from February to April unanswered; intent to disclose on 1 June; publication on 14 July. At least 197 Cursor versions shipped in the interval, by Mindgard's count — the last confirmed vulnerable is 3.2.16 (30 April); whether the current 3.11 release (10 July) is vulnerable is unconfirmed. As of 15 July there is no CVE, no advisory for this flaw and no patch; Cursor's security page commits to acknowledging reports within 5 business days. Mindgard cites metrics of 7M+ active users and 50K+ companies. Mindgard's mitigations: deny execution from workspace directories via AppLocker or Windows App Control, and open untrusted repositories "only in an isolated VM, Windows Sandbox, or other disposable environment"; The Hacker News adds a pre-open check of project roots for git.exe, npx.exe, node.exe and where.exe. Per The Hacker News, VS Code's own documentation describes an identical repo-root probe, though no source confirms VS Code is exploitable the same way. Mindgard's rationale for going public: "Withholding information no longer serves users, it serves silence."

Related: Snowflake's Cortex Code CLI executed malware via indirect prompt injection in March — a prior case of an AI coding tool running untrusted code. On Windows, Mindgard's isolation advice comes down to the built-ins — Windows Sandbox or a disposable VM. The same class is arriving for coding agents: Clawkwork's clawk, shipped on 13 July, though macOS-only today and no fix for this flaw. Cursor's release cadence continued through the disclosure window, including Composer 2, built on Kimi, in March.

Moonshot AI unveiled Kimi K3 on 17 July: a 2.8 trillion-parameter mixture-of-experts model — an architecture that activates only a subset of specialised sub-networks per token, here roughly 16 of 896 experts, or about 50 billion active parameters — with a 1 million-token context window, the largest open-weight model yet announced. The API is live now; full weights are promised by 27 July. Moonshot bills it as "the world's first open 3T-class model" — with its own caveat: "While its overall performance still trails the most powerful proprietary models, Claude Fable 5 and GPT 5.6 Sol, Kimi K3 demonstrated frontier-level performance across our evaluation suite."

The detail: Third-party evaluations at launch all ran against Moonshot's hosted API, not independently run weights: Artificial Analysis scores it 57 on its Intelligence Index against Claude Fable 5's 60 and GPT-5.6's 59; it entered Arena's Frontend Code leaderboard at #1 (1,679 points, 76% pairwise win rate) and Arena Text at #9 (1,486 points). The architecture — Stable LatentMoE, Kimi Delta Attention hybrid linear attention, MXFP4 weights via quantisation-aware training, a claimed "2.5x improvement in scaling efficiency over Kimi K2" — is vendor description until the weights land; per Tom's Hardware, "every published K3 number is a claim made by Moonshot... can't be verified until the weights are made public on July 27". Pricing is $3 per million input tokens ($0.30 on cache hits) and $15 output; latent.space's blended estimate is about $5.40 per million, versus its figures of roughly $9 for Opus 4.8 and $10 for GPT-5.5; cache-miss input is 5x Kimi K2's launch price of $0.60, per Tom's Hardware. latent.space also notes a hallucination rate that worsened to 51% from 39% on AA-Omniscience even as accuracy improved, inference around 28 tokens per second, and Moonshot acknowledging a "noticeable gap in user experience" against Fable 5 and GPT-5.6 Sol. Moonshot recommends 64+ accelerator supernodes to serve it, benchmarked on Nvidia H200 and an unnamed "GPGPU from an alternative vendor"; Moonshot says it contributed a KDA prefix-caching implementation to vLLM, available at release.

Related: Kimi K2 launched one year earlier to the week. Since then Moonshot raised $2 billion at a $20 billion valuation in May, GitHub Copilot added Kimi K2.7 Code in early July, and Cursor built Composer on Kimi in March; a report last week found Chinese open models led Hugging Face downloads this spring. One unresolved thread: in February Anthropic accused Moonshot of distillation training using, per Tom's Hardware, "3.4 million Claude exchanges" — none of this week's launch coverage records a response from Moonshot.

OpenAI's Codex CLI now encrypts inter-agent message payloads in versions after 0.137.0 with MultiAgentV2 enabled: the readable content field is left empty and the data lives only in an encrypted_content field, removing human-readable task and message text from local rollout history — the on-disk session log — and from trace and debugging surfaces. The change covers spawn_agent, send_message and followup_task; it was merged on 5 June in PR #26210, and GitHub issue #28058 — "Regression: encrypted MultiAgentV2 messages remove readable task audit trail" — has now been open for five weeks.

The detail: The issue, filed 13 June by ignatremizov and labelled CLI/bug/subagent, has no assignee and no visible maintainer response as of 15 July. The filer's complaint: it is now impossible to answer "What task did this spawn_agent call give the child agent?"; the proposed fix is "a separate non-encrypted audit field for the readable task text" alongside encrypted delivery to the model. OpenAI's rationale is in the PR: previously "the parent model can emit plaintext task text, Codex can persist it in history/rollouts, and the recipient can receive it as ordinary assistant-message JSON", and encryption prevents that exposure between model calls — a deliberate security measure with a documented auditability cost. A separate issue, #26753, tracks validation problems with encrypted tool schemas.

Related: What agent harnesses record — and hide — is a recurring theme: hidden Claude Code prompt markers in Edition #48, Claude Code's measured harness token overhead in Edition #49, and undocumented Claude Code features surfaced in May. The exposure OpenAI's change addresses is documented too: GitLost leaked private-repo content via prompt-injected agent output — a related, though distinct, exposure class to the inter-agent task text Codex now encrypts.

---