BELTDOWN2: ESCAPING THE CURSOR CLI SANDBOX

Summary from the TLDR InfoSec newsletter

A malicious workspace can place a core.fsmonitor hook in .git/config. Cursor CLI ran internal Git commands outside its macOS Seatbelt sandbox. A read-only prompt triggered git ls-files, which executed the hook. The proof payload wrote to $HOME, while sandboxed shell commands could not. Anysphere acknowledged the report and shipped Cursor CLI 2026.08.04-aaa8809, and the fix injects GIT_CONFIG environment settings into every Git spawn, disabling core.fsmonitor, custom hooks, and repository attributes.