SpaceX Cursor Acquisition: $60B Deal Meets DuneSlide Flaws

A record deal with a security footnote

SpaceX's purchase of Anysphere, the company behind the AI code editor Cursor, ranks among the largest startup exits on record. While the deal was moving from signature to close, Cursor also had to patch two critical vulnerabilities that could let an attacker take over a developer's machine without a single click. The two events are not formally linked, but together they show what a $60 billion AI coding tool now carries.

The deal: from option to subsidiary

The transaction began as a $60 billion acquisition option in April 2026. SpaceX exercised it on June 16, 2026, in a regulatory filing that came four days after the company's own IPO on June 12. 1 The consideration is entirely stock. Tech-insider.org estimates that it represents roughly 3.4% dilution against SpaceX's post-IPO valuation, and that outlet expected the deal to close in Q3 2026. 1

According to ValueAddVC, the deal closed on August 14, 2026. Cursor shares converted into about 389 million SpaceX Class A shares, and the company became part of a new SpaceXAI division. 2

The price is high compared with Cursor's recent private valuations:

• June 2025: a $900 million Series C led by Thrive valued Cursor at $9.9 billion. 2
• November 2025: a $2.3 billion Series D, co-led by Accel and Coatue with Google and Nvidia participating, valued it at $29.3 billion. 2

SpaceX therefore paid about double Cursor's last independent mark, roughly seven months after that round. Reports of Cursor's revenue vary. Tech-insider.org cites figures in both the $2 billion and $4 billion range in different parts of its coverage. 1 Readers should treat any single revenue number with caution. Even so, it is clear that SpaceX believes AI coding is a platform shift worth paying a large premium for. 1

The vulnerabilities: DuneSlide

On July 1, about two weeks after the deal was announced, details emerged of two flaws, CVE-2026-50548 and CVE-2026-50549. Both were patched in Cursor 3.0. 3 Security firm Cato named the pair "DuneSlide." Each carries a CVSS score of 9.8, near the top of the severity scale. 4

The flaws exploit a feature that makes Cursor's agent fast. Inside the editor's sandbox, the agent can run terminal commands automatically, without asking the user for approval. 4

CVE-2026-50548 abuses an optional working_directory parameter on Cursor's run_terminal_cmd tool:

1. The sandbox allows writes into a command's working folder.
2. When the agent sets that folder to a non-default path, Cursor adds the path to its allowed-write list without checking it. 3
3. Hidden instructions in a prompt can point the agent at a system location instead of the project folder.
4. An attacker can then overwrite the sandbox helper binary itself, after which later commands run without any sandbox. Shell startup files such as ~/.zshrc are also possible targets. 3

The second CVE reportedly works by subverting a safety check in a similar way. 3

The attack can be delivered through an ordinary interaction. SecurityWeek, citing Cato, describes a scenario in which a harmless-looking MCP server request injects the malicious prompt. The victim only needs to ask Cursor to ingest attacker-controlled content. 4 There is no approval box to click through or ignore. 3

Why the timing matters

The roadmap explains how Cursor reached this point. Version 0.50 in May 2025 introduced Background Agents that run tasks on their own while developers work on something else. 5 Later releases connected those agents to issue trackers such as Linear, added Agent Autocomplete for command suggestions, and introduced Hooks (beta) for observing and controlling agent behavior at runtime. 5

Each step gave the agent more autonomy, and autonomy is what DuneSlide exploited. The value of an agent that runs commands without asking comes with the risk of an agent that runs commands without asking.

In my reading, the episode is less a scandal than a preview of what SpaceX now owns. The flaws were disclosed and patched before the deal's August close, apparently through normal coordinated disclosure. Still, the attack surface is structural, not incidental. AI coding agents read untrusted content such as repositories, documentation, and MCP responses, and they treat that content as instructions. That makes prompt injection a permanent class of threat. A buyer paying $60 billion should expect more findings like this one.

What to watch

The practical step for developers is simple: confirm you are on Cursor 3.0 or later. 3

The larger question is whether SpaceXAI's ownership changes Cursor's priorities. Cursor will need to keep shipping more autonomous features while hardening the sandbox those features depend on. The DuneSlide patches suggest the company can respond quickly. The next test is whether it designs agent permissions so that a single injected prompt cannot get this far again.