Disclosed vulnerability
Aisle: one-click remote code execution through links in commit messages in Cursor, VS Code and Google Antigravity
AIR-2026-0257 AIR record · 2026-07-aisle-commit-message-link-rce
From the supporting source
malicious commands could be hidden within links found in commit messages. By clicking on them, you would unknowingly trigger data exfiltration, install persistent malware, or delete files.aisle.com
The record
Disclosed
2026-07-31
Vendor
Cursor (Anysphere); Microsoft; Google
Product
Cursor; Visual Studio Code; Google Antigravity
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels
System type
Generative model
Who acted
AI was the target (contested) — the flaw is link handling in agent-capable IDEs and needs a human click; contested because the agent's role in the chain is thin
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Malicious link in commit message
Impact type
Remote code execution, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
users of the three AI-enabled IDEs who click a link in a commit message
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Fixed by Google and Cursor on disclosure; Microsoft fixed VS Code somewhat later
Taxonomy & references
Curator notes
No CVE stated in the write-up. The AI-agent link is that the affected products are AI coding IDEs; the write-up centers on the IDE link-handling flaw and a human click, so the agent's own authority is a limited part of the mechanism. Autonomy coded at the least-autonomous label. No in-the-wild exploitation is claimed.
Supporting sources
Cite as
Enkrypt AI. "Aisle: one-click remote code execution through links in commit messages in Cursor, VS Code and Google Antigravity". AIR, AIR-2026-0257. https://agentincident.vercel.app/i/AIR-2026-0257/ (accessed 2026-10-19).