1-Click RCE Flaw in Cursor, VS Code, and Google Antigravity Exposes 50M Developers to Cyberattacks

A critical one-click remote code execution (RCE) vulnerability affects three of the world’s most widely used code editors: Cursor, Microsoft VS Code, and Google Antigravity.

The flaw, uncovered by AISLE, exposes an estimated 50 million software developers at risk of silent, total system compromise with nothing more than a single click on a malicious link.

The vulnerability has since been patched across all three platforms, but its discovery highlights how quickly security flaws can propagate across AI-native developer tooling.

1-Click RCE Vulnerability in Code Editors

The exploit hinged on a deceptively simple mechanism: an attacker could embed a malicious link inside a Git commit message. When a developer clicked that link inside the editor, the application executed arbitrary code with full terminal privileges, without displaying any confirmation dialog, warning prompt, or visible indication that anything had happened.

Victims had no way to detect the compromise in real time, giving attackers a completely covert entry point into a developer’s machine.

Once triggered, the vulnerability handed attackers the same level of access a developer has on their own laptop. This meant they could exfiltrate sensitive credentials such as OpenAI, Anthropic, and Stripe API keys directly from the local environment, install persistent malware including keyloggers that broadcast every keystroke to an external server, and freely crawl or delete files across the local file system.

Because the malware persisted even after the editor was closed, a single careless click could result in long-term, undetected surveillance of a developer’s entire workflow.

AISLE’s research team first identified the flaw in VS Code during automated vulnerability scanning in fall 2025. Because Cursor is built directly on top of the VS Code codebase, it inherited the same underlying weakness, making the two of the most popular AI-assisted coding environments simultaneously vulnerable.

AISLE responsibly disclosed the issue to both Microsoft and Cursor as soon as its AI system flagged the bug.

The story did not end there. In early 2026, the same vulnerability resurfaced in Google Antigravity, Google’s newly launched AI-assisted coding environment, which was also derived from the VS Code architecture.

AISLE promptly reported the issue to Google, which reacted quickly and remediated it within days. Cursor also moved fast to patch the flaw, while Microsoft’s fix for VS Code arrived somewhat later. As of now, none of the current versions of Cursor, VS Code, or Google Antigravity contain the vulnerability.

This case illustrates a growing pattern in the AI coding tool ecosystem: because many AI-native IDEs are forked from a common codebase like VS Code, a single vulnerability can silently ripple across multiple products used by tens of millions of developers before it is caught.

The speed and convenience that make these tools attractive for AI-assisted development are the same properties that accelerate the spread of security flaws. AISLE’s findings underscore the value of continuous, AI-driven vulnerability detection to catch issues that traditional pattern-matching security tools might miss.

Developers using any of these three editors should update immediately to the latest available versions to ensure they are protected. Given that this vulnerability could operate entirely without user awareness, teams should also review recent commit history and rotate any API keys or credentials that may have been exposed in projects handled through affected editor versions.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.