Critical RCE Flaw in Cursor, VS Code, and Google Antigravity Exposes 50M Developers

Key Takeaways

• A severe one-click remote code execution (RCE) vulnerability impacted Cursor, Microsoft VS Code, and Google Antigravity.
• The flaw, allowing silent system compromise via malicious Git commit links, potentially exposed 50 million developers.
• The vulnerability has been patched across all affected platforms, but its discovery highlights the propagation risks in AI-native developer tooling.
• Attribution: AISLE’s research team identified and responsibly disclosed the flaw.

Critical RCE Flaw Endangers 50 Million Developers Across Leading Code Editors

A significant one-click remote code execution (RCE) vulnerability has been identified, impacting three widely used code editors: Cursor, Microsoft VS Code, and Google Antigravity. This critical flaw could have allowed attackers to achieve complete system compromise on an estimated 50 million developer machines with a single click on a malicious link.

Although the vulnerability has since been remediated across all three platforms, its emergence underscores a critical security challenge within the rapidly evolving landscape of AI-native developer tools, where shared codebases can lead to widespread propagation of security weaknesses.

Exploiting the Supply Chain: A Covert RCE Mechanism

The exploit leveraged a remarkably simple yet effective method: embedding a specially crafted malicious link within a Git commit message. When a developer clicked this link from within their code editor, the application would silently execute arbitrary code with full terminal privileges. Crucially, no warning prompts, confirmation dialogs, or any visible indicators of compromise were presented to the user, making the attack entirely covert.

This stealthy mechanism meant that victims were unaware of the compromise in real-time, providing attackers with an unmonitored entry point into the developer’s workstation. Once triggered, the vulnerability granted attackers the same level of access as the legitimate user. This extensive access allowed for critical actions such as exfiltrating sensitive credentials like OpenAI, Anthropic, and Stripe API keys from the local environment, installing persistent malware like keyloggers to surreptitiously transmit keystrokes to external servers, and freely navigating or deleting files across the local file system.

The persistence of the malware, even after the code editor was closed, meant that a single, inadvertent click could lead to prolonged, undetected surveillance of a developer’s entire workflow and sensitive data.

Discovery and Disclosure Across Platforms

AISLE’s research team first identified this vulnerability in VS Code during automated vulnerability scanning conducted in the fall of 2025. Given that Cursor is developed directly atop the VS Code codebase, it inherently inherited the same underlying weakness, rendering both popular AI-assisted coding environments simultaneously susceptible.

Upon discovery, AISLE promptly and responsibly disclosed the issue to both Microsoft and Cursor. The vulnerability’s reach, however, extended further. In early 2026, the identical flaw reappeared in Google Antigravity, Google’s recently launched AI-assisted coding environment, which also derives its architecture from VS Code.

AISLE immediately reported the vulnerability to Google, which responded swiftly, deploying a fix within days. Cursor also moved quickly to patch the flaw, while Microsoft’s remediation for VS Code was released somewhat later. As of the latest updates, the current versions of Cursor, VS Code, and Google Antigravity are confirmed to be free of this specific vulnerability.

This incident vividly illustrates a burgeoning trend within the AI coding tool ecosystem: the extensive reliance on common codebases, such as VS Code, means that a single security vulnerability can silently propagate across numerous products, potentially affecting tens of millions of developers before detection. The very characteristics of speed and convenience that make these AI-assisted tools so appealing for development also inadvertently accelerate the dissemination of security flaws. AISLE’s findings underscore the critical importance of continuous, AI-driven vulnerability detection as a necessary defense against issues that traditional, pattern-matching security tools might overlook.

What You Should Do

• Update Immediately: All developers using Cursor, Microsoft VS Code, or Google Antigravity should update their editors to the latest available versions without delay to ensure protection against this vulnerability.
• Review Commit History: Given the covert nature of the exploit, development teams should review recent Git commit histories for any suspicious links or unusual activity, especially for projects handled using potentially affected editor versions.
• Rotate API Keys and Credentials: As a precautionary measure, rotate any sensitive API keys or credentials (e.g., OpenAI, Anthropic, Stripe) that may have been exposed in projects developed with vulnerable editor versions.
• Implement Endpoint Detection and Response (EDR): Enhance developer workstation security with robust EDR solutions capable of detecting unusual process execution or file system modifications.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.