CVE-2026-26268: Cursor IDE AI Agent Executes Malicious Git Hooks, Enabling Full Machine Compromise

Summary

Security researchers at Novee published a technical breakdown of CVE-2026-26268, a high-severity arbitrary code execution vulnerability in Cursor IDE discovered in early 2026. The exploit leverages an interaction between Git's standard pre-commit hook mechanism and Cursor's autonomous agent behavior: an attacker embeds a bare Git repository containing malicious hooks within a legitimate-looking repository. When the AI agent autonomously executes standard Git operations (checkout, commit), the ho