AI coding agent security broke badly in 2026: a CVSS 9.8 pair in Cursor, a symlink flaw across six assistants, and $12M …
