Cybersecurity firm HiddenLayer reported that the AI programming tool Cursor suffers from a "CopyPasta License Attack" vulnerability. Hackers can trick the AI tool into injecting exploits into code repositories by hiding malicious instructions in LICENSE.txt and README.md files. This tool is widely used by crypto exchanges such as Coinbase. The attack exploits Markdown comments to hide prompt injections, allowing the AI to automatically spread malicious payloads when editing files. Testing has revealed that AI programming tools such as Windsurf, Kiro, and Aider also suffer from vulnerabilities. Malicious code can create backdoors, steal sensitive data, or paralyze systems, and can be deeply hidden to avoid detection. When HiddenLayer created a test for a virus-containing code repository, Cursor automatically copied the prompt injections into the newly generated files. The company warned that this mechanism could have more serious consequences, including compromising critical files in development and production environments. In August, the Coinbase engineering team stated that Cursor was the preferred tool for most of its developers, and as of February, it had covered all engineers. (Cointelegraph)