Cursor, VS Code, Antigravity: 1-Click RCE via Git Commit Links — What to Do

TL;DR

A single click on a malicious Git commit link inside Cursor, VS Code, or Google Antigravity was enough to give an attacker full terminal access to your machine. Security firm AISLE found the bug, all three editors shipped patches, but the shared architecture that made the fix possible is also why all three were vulnerable at the same time. If you have not updated your editor in the last week, update now.

What Happened

On July 31, 2026, AI-native security firm AISLE disclosed a one-click remote code execution vulnerability affecting Cursor, Microsoft VS Code, and Google Antigravity. Researcher Stanislav Fort found that an attacker could embed a malicious command inside a Git commit message link. Clicking that link from within any of the three editors ran arbitrary code with full terminal privileges. No download, no suspicious file to open, no warning dialog.

AISLE estimated 50 million developers were exposed. Anyone who opens a Git repository, browses commit history, and clicks a link could be compromised.

Why Three Tools at Once

Cursor and Google Antigravity are built on the VS Code architecture. When AISLE's automated scanners found the bug in VS Code in fall 2025, they checked the derivatives and found the same flaw in both Cursor and Antigravity. Shared code means shared vulnerabilities.

This is not new. Electron apps inherit Chromium bugs. VS Code forks inherit VS Code bugs. But the AI coding tool explosion has pushed this pattern further: when every new editor starts as a fork of the same open-source core, a bug in the core becomes a bug in the entire ecosystem.

The disclosure was coordinated. AISLE worked with Microsoft, Cursor (Anysphere), and Google to ship patches before the public blog post went live. As of early August 2026, all three editors have released fixes.

What the Attacker Could Do

The exploit payload lived entirely inside a Git commit message. That is content developers browse routinely during code review, blame inspection, and repo exploration. No prior access needed.

After compromise, an attacker could:

• Read and exfiltrate source code from every repo on the machine
• Steal cloud credentials from environment variables and config files
• Access SSH keys and pivot to production infrastructure
• Deploy backdoors into the developer's own projects
• Use the machine as a jump host into internal networks

For AI coding tool users, there is an extra sting. These editors hold API keys for multiple model providers. A Cursor compromise means your Anthropic, OpenAI, and Google API keys are all up for grabs in one shot.

What to Do

Update immediately. Cursor, VS Code, and Antigravity have all shipped patches. Check your version. If you are on anything older than the patched releases, update now.

Do not click links in commit messages. Even with the patch, this is a solid habit. Commit messages are attacker-controlled text. Treat them the way you treat links in unsolicited email.

Audit your editor's Git integration. The bug exploited the clickable link feature in commit message rendering. If you do not rely on GitLens-style inline links, turn them off.

Rotate keys if unsure. If you have clicked commit message links on an unpatched editor, rotate your API keys, SSH keys, and cloud credentials. Assume the worst and move on.

Check your extensions. Third-party Git visualization extensions may carry similar risks even on a patched core editor. Review what you have installed.

The Real Takeaway

This bug is not about AI. It is a plain input sanitization failure in Git commit rendering. But it matters for the AI coding tool ecosystem because of scale and concentration.

Three tools sharing one codebase means three tools sharing one attack surface. As the AI editor market consolidates around VS Code-derived architectures, we are building a monoculture. Monocultures make every bug's blast radius wider.

The AISLE finding also exposes a gap in how we talk about AI editor security. Most of the conversation is about prompt injection, model poisoning, and agent misbehavior. The boring stuff (link rendering, file parsing, extension sandboxing) has not gotten the same scrutiny. The next AI editor vulnerability probably will not be an AI problem. It will be a 2018-era Electron bug that nobody fixed because "it is just a text editor."

Update your editor. Then ask what else in your toolchain runs on shared infrastructure you have not audited.