Cursor is also vulnerable to prompt injection through third-party content.

this is one reason to favor specialized agents and/or tool selection with guards (certain tools cannot appear together in a LLM request)