Cato AI Labs, the research arm of Cato Networks, discovered two critical vulnerabilities in Cursor AI code editor, named DuneSlide (CVE-2026-50548 and CVE-2026-50549). These flaws allow zero-click sandbox escape via prompt injection. Cato reported the issues in February 2026 and disclosed them publicly in July 2026.