AIR-2026-0253 · Cymulate: untrusted-binary resolution and config-file poisoning give code execution in Cursor CLI, AWS Kiro, Codex, Gemini CLI and GitHub Copilot CLI

Cymulate: untrusted-binary resolution and config-file poisoning give code execution in Cursor CLI, AWS Kiro, Codex, Gemini CLI and GitHub Copilot CLI

AIR-2026-0253 AIR record · 2026-06-cymulate-ai-cli-binary-resolution-rce

From the supporting source

Simply opening a project or interacting with AI-generated content can trigger the attack chaincymulate.com

The record

Disclosed

2026-06-04

Vendor

Cursor; Amazon Web Services; OpenAI; Google; GitHub (Microsoft)

Product

Cursor CLI; AWS Kiro; OpenAI Codex; Gemini CLI; GitHub Copilot CLI

Risk domain

Access control and permissions › Privilege escalation

System type

Generative model

Who acted

Agent acted (contested) — the planting step uses the agent's own file-write tool, after which the CLI resolves the attacker-placed binary; contested because the final execution is conventional binary resolution

Attack surface

Coding agent

Autonomy level

Semi-autonomous

Initial vector

Prompt injection file write then untrusted executable resolution

Impact type

Remote code execution

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI03 – Identity and Privilege Abuse
MITRE ATLAS: AML.T0055 – Unsecured Credentials
NIST AI RMF: GOVERN 6.1
EU AI Act: Article 13
ISO/IEC: TR 24028; 42001; 23894
AIUC-1: B. Security
Scope: tool misuse
Mitigation: Apply least-privilege principle; Regular policy audits.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

Windows users of the listed CLIs and Kiro IDE users who open a poisoned repository or process injected content

Capability abused

file_write_tooltool_discovery_search_pathworkspace_config_autoload

Defense & remediation

Recorded defense

vendor approval and sandbox models, which the research reports as not engaged by the attack chain

Guardrail kinds

Human approval, Sandbox isolation

Guardrail outcome

Silent

Fix shipped

Kiro fixed in 0.11 (AWS bulletin 2026-037-AWS); other vendors vary, see notes

Curator notes

One record for the coordinated disclosure. CVE-2026-10591 and AWS bulletin 2026-037-AWS cover only the Kiro file-write issue (writes to execution-sensitive paths such as the workspace task configuration; fixed in Kiro 0.11 with explicit approval now required). Per-vendor outcomes as stated by Cymulate: Cursor CLI report closed as informative and still vulnerable at publication; GitHub Copilot CLI triaged, bounty paid, severity downgraded to low, no fix committed; Gemini CLI acknowledged, remediation status unknown; Codex desktop report closed without meaningful technical engagement. Cymulate separately published a deeper Codex write-up. Cymulate describes the vendor responses collectively as ranging from thorough engagement to dismissal. Quote is from Cymulate; the AWS bulletin carries the Kiro CVE text. Demonstrated only; no exploitation reported.

Cite as

Enkrypt AI. "Cymulate: untrusted-binary resolution and config-file poisoning give code execution in Cursor CLI, AWS Kiro, Codex, Gemini CLI and GitHub Copilot CLI". AIR, AIR-2026-0253. https://agentincident.vercel.app/i/AIR-2026-0253/ (accessed 2026-10-19).