Vulnerability in Cursor, VS Code, and Antigravity could steal API keys
- Evelyn Carter
- Aug 7
- 4 min read
On July 31, 2026, AISLE disclosed a one-click remote code execution vulnerability affecting Cursor, Microsoft Visual Studio Code, and Google Antigravity. A malicious link embedded in a Git commit message could trigger command execution, expose API keys, or install malware. The flaw has been fixed, and no public CVE has been assigned.
A link displayed in source-code history is not usually treated as a serious security threat. However, AISLE’s research indicates that a single click on a specially crafted link in a Git commit message could allow an attacker to execute commands on a developer’s computer.
What happened to these three widely used development tools?
AISLE said its automated analysis system discovered a remote code execution, or RCE, vulnerability in Visual Studio Code in the fall of 2025. Because Cursor is built on top of Visual Studio Code, the same weakness also appeared in Cursor.
In 2026, AISLE found a similar mechanism in Google Antigravity, Google’s AI-assisted development environment. The researchers then reported the issue to Microsoft, Cursor, and Google through a coordinated disclosure process.
IPSIP Vietnam previously examined another unpatched security issue affecting the Cursor AI application. That case provides additional context for organizations assessing how rapidly evolving AI development tools may introduce security risks outside traditional application vulnerability management.
How could one click lead to API key theft?
An attacker could hide a malicious command inside a link placed in a Git commit message. When a developer views the change history and clicks the link inside the code editor, the application may execute arbitrary code without displaying a clear warning or confirmation prompt.
Component | Risk description |
Delivery point | Malicious link embedded in a Git commit message |
Trigger condition | Developer clicks the link inside the coding tool |
User warning | A confirmation dialog may not appear |
Execution privilege | Terminal privileges of the current user account |
Data at risk | API keys, tokens, source code, and local files |
Post-exploitation activity | Data theft, keylogger installation, or file deletion |
Patch status | Fixed in current versions |
CVE identifier | Not publicly disclosed by AISLE |
Does the figure of 50 million developers represent confirmed victims?
No. AISLE stated that Cursor, Visual Studio Code, and Google Antigravity are used by approximately 50 million software engineers. This figure represents the estimated combined user base of the three platforms, not the number of people attacked or devices confirmed to contain the vulnerability.
The public research does not explain how the 50 million figure was calculated, how many users belong to each product, or how much overlap exists among those user groups. The number should therefore be presented as AISLE’s estimate rather than an independently verified impact count.
Why does this vulnerability matter to businesses?
Developer devices are often more sensitive than standard office workstations. In addition to source code, they may store environment configuration files, Git tokens, SSH keys, cloud credentials, and API keys used for development or testing.
If a high-privilege credential is stolen, the attacker may no longer need to remain on the original workstation. The exposed key could be used from another infrastructure to access repositories, third-party services, build systems, or cloud resources.
Organizations adopting AI coding practices should also assess the risks associated with rapid or lightly governed development. IPSIP’s analysis of vibe coding risks for businesses provides further context on insecure code generation, uncontrolled tool adoption, and limited review of AI-produced outputs.
What should organizations do immediately?
Identify every device running the three affected tools.
Deploy updates through a centralized software management system.
Instruct users not to open links from untrusted commit messages.
Review unusual shell or terminal processes launched by the IDE.
Investigate unexpected outbound connections from developer workstations.
Look for bulk access to configuration files and source-code directories.
Revoke API keys, tokens, or SSH keys showing signs of exposure.
Review unauthorized changes in Git repositories and CI/CD pipelines.
Isolate devices showing signs of keyloggers, malware, or persistence.
Preserve forensic evidence before reimaging a suspected device.
What does IPSIP Vietnam’s expert perspective indicate?
Potential consequences include source-code theft, API key exposure, service account compromise, pipeline manipulation, and release disruption. If stolen credentials have broad permissions, the incident may spread from one endpoint to multiple business systems.
IDEs, extensions, and AI coding assistants should be included in asset inventories, patch management, and endpoint monitoring programs. The fact that multiple products share a common codebase also means organizations should not assess vulnerabilities brand by brand in isolation.
The vulnerability in Cursor, Visual Studio Code, and Google Antigravity demonstrates that software development environments have become a critical part of the enterprise attack surface. A single click on a link embedded in Git metadata could create a path to API keys, source code, and systems accessible from a developer workstation.
Vietnamese organizations should update the affected tools, investigate suspicious activity, and rotate credentials that may have been exposed. In the longer term, developer workstations should be managed as privileged devices with restricted access, continuous monitoring, and clear separation from production environments.
References
Comments