Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / cursor

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-cursor-release-note-security-repairs-need-surface-specific-upgrades-and-bounded-advisory-claims

Release-note security repairs need surface-specific upgrades and bounded advisory claims. Vendor release notes report seven repairs to execution, agent context or controls. These include a branch name reaching a shell, browser pages forging agent input, repository hooks being skipped, and MCP server confirmation requirements being bypassed. Privacy crash uploads, Bitbucket outside-repository reads and SDK bridge startup configuration also changed. No matching public advisory or CVE was found in the checked sources, not proof that none exists anywhere.

Channel: tagged-release (IDE 3.22 through 3.24 and SDK 1.0.32); docs-only (Cloud Agents service fix). Half: defect. Date: 2026-09-22..2026-10-09.

Operator consequence: Install IDE 3.24.18 for the dated close and SDK 1.0.32 or later; 1.0.37 is current. Audit earlier Source Control commits that depended on secret-scanning hooks and confirmation-required MCP actions before 3.23. The Bitbucket change is hosted-service behavior. Follow per-surface notes alongside advisories; neither a new binary nor advisory silence proves every sandbox path safe.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-cursor-release-note-security-repairs-need-surface-specific-upgrades-and-bounded-advisory-claims

Profile citations

  • cursor / claim / release-note-security-repairs

Source links

Primary links, including exact changelog lines when available.

  1. Cursor
    official docs2026-10-13-cursor-release-note-security-repairs-need-surface-specific-upgrades-and-bounded-advisory-claimscursor.com/docs/release-notes/ide#oct-9-2026official docs2026-10-13-cursor-release-note-security-repairs-need-surface-specific-upgrades-and-bounded-advisory-claimscursor.com/docs/release-notes/ide#sep-24-2026official docs2026-10-13-cursor-release-note-security-repairs-need-surface-specific-upgrades-and-bounded-advisory-claimscursor.com/docs/release-notes/agents-window#oct-1-2026official docs2026-10-13-cursor-release-note-security-repairs-need-surface-specific-upgrades-and-bounded-advisory-claimscursor.com/docs/release-notes/cloud-agents#sep-28-2026official docs2026-10-13-cursor-release-note-security-repairs-need-surface-specific-upgrades-and-bounded-advisory-claimscursor.com/docs/release-notes/sdk#sep-22-2026official docs2026-10-13-cursor-release-note-security-repairs-need-surface-specific-upgrades-and-bounded-advisory-claimsgithub.com/cursor/cursor/security/advisories

Versioned source: run artifact