Oasis Security has identified a vulnerability in Cursor , an AI-based code editor, that allows hidden code to run as soon as a user opens a project folder without any action or warning.