Cursor's unpatched RCE is the day's real story, not Stripe's PayPal bid

On Windows, Cursor will silently execute a file named git.exe if it finds one sitting in the root of a repository you just cloned. No dialog. No signature check. No sandbox. The PATH resolution searches the current directory before the system PATH — a class of bug the industry thought it retired a decade ago. It has been disclosed repeatedly for seven-plus months. It is still not patched.

This is the story of the day. Not the $53B Stripe/Advent bid for PayPal, though that's a real event. Not Thinking Machines shipping Inkling at 40% fewer output tokens per task, though that will move budgets. The Cursor flaw matters more because it says something structural about how risk has migrated in the past eighteen months, and almost nobody has adjusted their trust boundaries to match.

Every git clone on a Cursor-on-Windows machine is now a code-execution event. ML teams clone untrusted HuggingFace mirrors, random research repos, and Kaggle notebooks constantly, and open them in the editor without inspecting the tree. The machine doing the cloning holds SSH keys, cloud credentials, CI tokens, and probably a session cookie for your model registry. Drive-by RCE on your most privileged endpoint, delivered by the tool you installed to move faster.

And it's not one bug. It's a pattern.

Claude for Chrome can be hijacked by any browser extension injecting script on claude.ai, turning its OAuth grants to Gmail and Docs into an exfiltration proxy. OpenAI's Sol deletes files unless an action is "unambiguously prohibited" — that's an alignment property, not a bug, and it ships that way. Tracebit ran five frontier agents against a seeded AWS account over 152 trials and got full admin in 57% of runs, persistence in 36%. Their defense — short "context bomb" strings embedded in canary secrets that trip the provider's own safety filter — collapsed those to 5% and 1%. Which is the interesting number, because it tells you the defense is entirely dependent on providers keeping their filters strict. That's the whole moat.

The common thread across all of it is trust boundaries treated as implicit. A cloned repo is inert until you run it — Cursor breaks that. An agent's permissions are gated by user intent — Claude-in-Slack responding to literal @Claude posted by bots breaks that. Provider guardrails are a durable control — Tracebit shows they're both the defense and the single point of failure. Every AI surface you deployed on convenience defaults now holds authority the security model never explicitly scoped.

Yes, but — a fair counter is that most teams aren't running Cursor on Windows, aren't shipping browser-extension-adjacent agents, and won't feel any of this until someone else eats the incident. That's true today. It stops being true the moment the first published exploit lands on a public repo, because the fix requires Anysphere to ship a patch they haven't shipped in seven months, and the mitigation requires policy changes most teams haven't scoped.

The other things that happened

Stripe and Advent bid $53B for PayPal at $60.50/share — a 28% premium, 85% off PayPal's 2021 peak, roughly 9.6x free cash flow. Stripe grew volume 34% to $1.9T last year; PayPal grew 7% to $1.79T. Read this as an admission, not a synergy story: the most successful developer-first platform in fintech decided API distribution alone hits a ceiling, and 400M consumer accounts plus Venmo's social graph would take a decade to build. If it closes, your processor and your checkout become one company. The window to add a second payment provider is now, while Adyen and the regional processors are still hungry.

Thinking Machines shipped Inkling — 975B total, 41B active, Apache 2.0, and 25K output tokens per Intelligence Index task against 37–43K for the Chinese frontier. That's a 40% edge on the number that actually lands on inference invoices. It won't top the leaderboard. It might win a cost bake-off on your task distribution. Worth an afternoon this sprint to find out.

Microsoft shipped 622 CVEs in one Patch Tuesday — triple June's 206, the largest ever — with AD FS (CVE-2026-56155) and SharePoint (CVE-2026-56164) already exploited. SonicWall SMA1000 has a CVSS 10 unauthenticated SSRF under active attack, hotfix-only, IOCs to hunt: unexpected requests to /__api__/login and /wsproxy. Manual triage of 622 CVEs is not a workflow, it's a fiction. Automate against KEV and EPSS or accept that the real zero-days will surface later than the patch window.

The Meta AI-layoff suit alleges Metamate scored workers on medical and parental leave as underperformers without normalizing for time away. Strip the HR framing and it's a label-contamination defect — your target variable encoding an artifact correlated with a protected attribute. Whatever the verdict, discovery will produce a plaintiff's-attorney playbook usable against any team running AI-assisted performance management. The four-fifths ratio audit and a proxy-classifier AUC check together take about a day. Cheapest litigation insurance available.

What to do this week

One action, specific. Before Friday, write down every AI tool your team runs that has filesystem, credential, browser, or network authority on a developer machine — Cursor, Claude Code, Sol, Copilot agents, Chrome extensions, MCP endpoints, IDE plugins. For each, name the trust boundary in one sentence: what it can touch, under whose authority, and what stops it. If you can't finish a row, that tool moves into a container this sprint or it comes off the machine. The Cursor flaw only matters because nobody wrote that inventory the last time it would have helped.