Should opening a Git repository execute code?

A recently disclosed issue in Cursor raises an important question about AI-powered development tools.

Researchers found that Cursor on Windows could execute a repository's git.exe during Git discovery, while Cursor argues that repositories themselves are part of the trust boundary.

This article examines the disclosure timeline, the differing security perspectives, and the lessons for developers working with untrusted code repositories.