Cursor Security Flaws Shadow SpaceX's $60B AI Coding Deal

A Record Exit, Closed Under a Cloud

SpaceX has completed its all-stock acquisition of Anysphere, the company behind the AI code editor Cursor, at a valuation of roughly $60 billion. The deal closed on August 14, 2026. 12 Cursor's shares were converted into about 389 million SpaceX Class A shares, and the editor now sits inside a newly created SpaceXAI division. 2 It ranks among the largest startup exits on record. 2

The headline number is striking for its speed. Cursor carried a $400 million post-money valuation at its Series A in August 2024, which makes the SpaceX price a roughly 150x markup in two years. 1 The climb ran through a $900 million Series C led by Thrive in June 2025 at $9.9 billion. It continued with a $2.3 billion Series D in November 2025, co-led by Accel and Coatue with Google and Nvidia participating, at $29.3 billion. 12 Annual recurring revenue reportedly passed $4 billion along the way. 1

Accounts of the deal's timeline differ slightly. One account traces the $60 billion figure to an option agreement in April 2026. 1 Another describes the acquisition as announced in June 2026. 2 Both points can be true: a price agreed privately in spring and made public in early summer is a familiar sequence. The closing date, however, is consistent across reporting.

The Vulnerabilities Arriving Alongside the Deal

The same months that took Cursor from option agreement to closing also produced a run of serious security disclosures.

In February 2026, Cursor published CVE-2026-26268, a high-severity arbitrary code execution flaw found by researchers at Novee. 3 The bug did not sit in Cursor's own product logic. It came from how Git features interact, and it becomes exploitable once an AI agent starts running Git operations on its own inside a repository it doesn't control. 3 The result is attacker code running directly on a developer's machine. 3 Novee published its write-up in late April after coordinated remediation with the vendor. 3

The more alarming disclosure came in early July. Cato researchers detailed a pair of flaws, CVE-2026-50548 and CVE-2026-50549, collectively dubbed DuneSlide, each rated 9.8 on the CVSS scale. 4 They enable zero-click prompt injection that breaks out of Cursor's sandbox and executes arbitrary code on the underlying operating system. 4 According to the research, the attack abuses Cursor's automatic terminal command execution inside the sandbox, which runs without asking the user for approval. It can be triggered when a victim asks the IDE to ingest attacker-controlled content. 4 One of the issues concerns the sandbox's boundaries, which are supposed to confine command execution to the current working directory. 4 Cursor has patched both. 4

Why Agent Features Widen the Attack Surface

Both bugs trace back to the features that made Cursor valuable. The 0.50 release in May 2025 introduced Background Agents, which carry out tasks on their own while developers do other work. 5 Later releases let teams launch those agents straight from Linear tickets, added Agent Autocomplete for command suggestions, and shipped Hooks in beta for observing and steering agent behavior at runtime. 5

Each step gave the agent more freedom to act without a human approving every move. That is the selling point, and it is also the exposure. The Git-hook flaw needed an agent willing to run repository operations unprompted. 3 DuneSlide needed terminal execution that skipped user approval. 4 In both cases, the attacker's path ran through content the developer handed to the AI, such as a cloned repo or an ingested payload, rather than through a conventional software bug. Novee's framing is blunt: the IDE is no longer a safe zone. 3

What It Means for SpaceX

In my reading, these disclosures are not a reason to doubt the deal's logic. Cursor patched the flaws through coordinated disclosure, which is how mature vendors behave. 34 SpaceX's valuation also rests on revenue and growth, not on a claim of flawless security. 1

The disclosures do sharpen the obligation SpaceX has taken on. A tool with this much autonomy on developer machines is now owned by a company whose core business involves sensitive, often regulated engineering work. A string of near-critical sandbox escapes in a single year suggests that agentic coding tools are still working out where their trust boundaries should sit. Approval prompts, directory confinement, and treating untrusted repositories as hostile input will likely matter as much to SpaceXAI's future as model quality.

The $60 billion price reflects how quickly developers adopted autonomous coding agents. The CVE list shows how quickly attackers noticed them too. The real test of the acquisition will be whether SpaceX can harden Cursor's agents without slowing them down enough to lose the users who made it worth buying.