Cursor 0-day: a planted git.exe runs when you open a repo
An unpatched Cursor 0-day executes a planted git.exe the moment you open a repo. How it works, why agent guardrails miss it, and what to do now.
Read post ↗Your coding agent is uploading your repo. I checked.
Grok Build CLI uploads your repo and .env by default. I read the binary, caught it on the wire, and blocked the leak without breaking the tool.
Read post ↗Why every decision lives in SQLite
We chose SQLite as agentjail's decision store. Not a log file. Not a remote API. Here is why local-first storage matters for security tooling.
Read post ↗Why we use policy, not prompts
Most agent safety relies on system prompts or LLM-based evaluation. We chose deterministic Rego policy instead. Here is what that buys you.
Read post ↗