Top Agentic AI security resources — August 2026

What it is

This is a roundup, but it carries specifics the existing summary omits: exact CVE numbers with CVSS scores and fixed versions, exploit mechanisms, and a concrete "fix before September" checklist. The two most actionable items for an engineer are the DuneSlide Cursor RCEs and the Kiro CVE's patched version.

How it works

• DuneSlide (Cursor): CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8, zero-click. Injection arrives via MCP or poisoned search results and abuses working_directory or a symlink-canonicalization fallback to overwrite Cursor's sandbox helper.
• DeepJack (Cursor deeplink): nested cursor:// deeplinks plus whitespace-padded arguments push a malicious MCP install command off-screen in Cursor's confirm dialog, turning a "review this PR" click into unsandboxed RCE. Still reproducible in build 3.9.8 — no fix version given.
• Kiro (CVE-2026-10591): CVSS 8.8/8.6. Hidden one-pixel text on a web page makes Kiro rewrite its own mcp.json and auto-launch an attacker-controlled MCP server with developer privileges. Assigned July 22, fixed in v0.11.130.
• ClaudeBleed (Claude for Chrome): any co-installed Chrome extension can forge a trusted click via a missing event.isTrusted check, driving Claude for Chrome to read Gmail/Docs/Calendar through nine allowlisted task IDs. CVSS 7.7, rising to 9.6 with auto-execution enabled. Reported to Anthropic May 21, still reproducible in v1.0.80 as of July 7 — no fix version stated.

Preconditions / Affected

• DuneSlide / DeepJack: Cursor IDE, MCP-connected or deeplink-handling configurations.
• Kiro: versions prior to v0.11.130.
• ClaudeBleed: Claude for Chrome with any co-installed extension; risk escalates sharply if auto-execution is enabled.

What to do

The page's concrete remediation steps:

• Patch Kiro to v0.11.130 or later.
• Inventory every agent identity and the connector scopes it inherits.
• Confirm your tooling gives full visibility into agentic actions and can reconstruct the full action chain from telemetry.
• Run Anthropic's four-question CISO framework (untrusted content, actions, blast radius, observability) against one real deployment this month.
• Score that deployment against the CSA/OWASP maturity model to establish a baseline.

Caveats

• DeepJack and ClaudeBleed are reported as still reproducible in the latest tested builds (Cursor 3.9.8, Claude for Chrome v1.0.80) with no fix version given on this page.
• The Hugging Face incident write-up explicitly separates supported claims from unproven ones — treat details beyond "sandbox escape, 17,000+ logged actions" as not yet confirmed per the source.