AI and IT News Recap: July 2, 2026: A Zero-Click Cursor Exploit, a Cheaper Agentic Claude, and AI's Phantom Domains
By Noah Smith, Owner & Consultant, KeyChange Technologies · July 2, 2026
Here is the AI and IT news for July 2, 2026. The theme of the day is the same tension we keep circling back to: the tools that make your team faster are also the ones attackers are learning to turn against you. Today's lead is a pair of critical flaws in Cursor, the AI code editor a lot of "vibe coders" now live in, that let a single hidden instruction take over a developer's machine. Around it: a cheaper and more capable Claude, a clever new phishing trick built on the mistakes AI makes, six NetScaler patches, a quiet-but-large Azure password spray, and Anthropic's Fable 5 coming back online.
📌 The AI and IT news at a glance
- 🔝 Two critical Cursor flaws ("DuneSlide") let a hidden prompt escape the sandbox and run any command on a developer's machine, with no click required.
- 🤖 Anthropic ships Claude Sonnet 5 as the new default, cheaper and more agentic than the model it replaces.
- 🤖 "Phantom squatting": attackers register the fake web domains AI models invent, then wait for the AI to send victims there.
- 🛡️ Citrix patches six NetScaler ADC and Gateway flaws that allow file reads and denial-of-service.
- 🛡️ A password spray made 81 million login attempts against Azure CLI and slipped past MFA at dozens of firms.
- 🛡️ The "ClickFix" scam grows a back office, serving each victim custom malware from an API.
- 🧰 Anthropic restores Claude Fable 5 worldwide after the US lifts its export controls.
🔝 Top story: A hidden prompt can hijack Cursor and take over a developer's machine
Researchers at Cato AI Labs disclosed two critical vulnerabilities in Cursor, the popular AI code editor, that together let a single ordinary-looking prompt break out of the editor's safety sandbox and run any command on the developer's computer. There is no link to click and no approval box to ignore. The pair is named DuneSlide, tracked as CVE-2026-50548 and CVE-2026-50549, and both are rated 9.8 out of 10.
The way in is prompt injection. The attacker never types into your Cursor. They plant hidden instructions inside something your AI agent reads on your behalf, such as a connected tool over the Model Context Protocol or a page returned by a web search. You ask a normal question, the hidden instructions ride along, and because no click or approval is needed, the attack is "zero-click." Both flaws use the same move: trick the agent into writing one file it should not be allowed to touch, then use that write to switch the sandbox off entirely. Once the sandbox is gone, the next command runs with your full access, which means control of the machine plus any cloud or SaaS accounts the editor is signed into. The good news is the fix is already out: both bugs are patched in Cursor 3.0, released April 2, and every earlier version is affected. Cato found no sign of real-world attacks, and says it is disclosing similar flaws in other coding agents because the problem looks structural rather than a one-off.
In short: Two critical Cursor flaws let a hidden prompt escape the editor's sandbox and run commands on a developer's machine, and both are fixed in Cursor 3.0.
What it means for your business: If your team uses Cursor, update to 3.0 or later now, because the vendor says more than half the Fortune 500 run it, and this class of attack needs no mistake from the user to work.
My take: This is the clearest example yet of why "the AI reads the web for you" is a security decision, not just a convenience. The whole value of an agent is that it acts on what it reads, which is exactly the door attackers walk through. Patching Cursor closes this instance, but the real lesson is to run these agents with the least access they can get away with and to treat anything they ingest from the open web as untrusted input.
Source: The Hacker News: Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands
🤖 AI generally
Anthropic ships Claude Sonnet 5 as its new default: cheaper, and built to run agents
Anthropic released Claude Sonnet 5, the newest version of its mid-size model, and made it the default for Free and Pro users. The pitch is that it can plan, use tools like browsers and terminals, and run multi-step jobs on its own at a level that until recently needed larger, pricier models. It is available at an introductory price of per million input tokens and
claude-sonnet-5 through the API, and it is also in Claude Code and on the Claude Platform.
The interesting part for buyers is not the benchmark bragging, it is the price-per-capability curve. Each generation pushes work that used to require a flagship model down into a cheaper tier, which is precisely what makes always-on agents financially plausible rather than a science project.
In short: Anthropic launched Claude Sonnet 5, a more agentic mid-size model, and made it the default for Free and Pro users at a discounted introductory price.
What it means for your business: If you priced out an AI agent workflow a few months ago and it looked too expensive, the math may have changed, so it is worth re-running the numbers before you commit to a plan or a competitor.
My take: The steady story of 2026 is that "good enough to run a real workflow" keeps getting cheaper. That is genuinely good for small teams. Just remember that cheaper per token plus more autonomous steps can still add up to a real bill, so measure cost per finished task, not cost per prompt, before you flip an agent to always-on.
Source: TechCrunch: Anthropic launches Claude Sonnet 5 as a cheaper way to run agents
"Phantom squatting": attackers register the fake domains that AI makes up
Palo Alto Networks' Unit 42 detailed a phishing technique it calls phantom squatting, and it is a clever inversion of how we usually think about AI mistakes. Language models routinely invent web addresses that do not exist. Attackers now register those made-up domains first, stand up a phishing page, and wait for AI tools to confidently point users at them. To measure the scale, Unit 42 asked two models roughly 685,000 questions about 913 well-known brands. The models produced 2.1 million links, of which about 250,000 pointed to unowned domains that anyone could grab, and threat feeds had already flagged more than 13,000 as outright malicious.
What makes this hard to defend against is that a brand-new domain has no bad reputation yet, so blocklists have nothing to flag until it is too late. Worse, the models tend to hallucinate the same fake domains for the same questions, which hands attackers a predictable target list. In one documented case, Unit 42 predicted a fake domain 23 days before an attacker registered it and ran a live phishing kit that copied a real storefront and stole card and ID data.
In short: Attackers are registering the nonexistent domains AI models hallucinate, then hosting phishing pages there to catch traffic the AI itself sends over.
What it means for your business: Tell your team not to trust a web link just because an AI produced it, and keep AI agents from automatically opening or downloading from model-generated links without a human check.
My take: This one reframes "AI hallucination" from a quality annoyance into an attack surface. The fix is not technical wizardry, it is a habit: treat anything a model writes, links most of all, as an unverified draft. Confirm the real, official domain before anyone types a password or pastes it into code.
Source: The Hacker News: Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware
🛡️ IT and security
Citrix patches six NetScaler flaws that allow file reads and denial-of-service
Citrix released security updates for six vulnerabilities in NetScaler ADC and NetScaler Gateway that could let an attacker read arbitrary files or knock the appliance offline. The headline bug, CVE-2026-8451 (CVSS 8.8), is a memory-overread flaw that shows up when the appliance is configured as a SAML identity provider, and researchers at watchTowr note it shares a root cause with an earlier NetScaler flaw from March. Several of the others are denial-of-service issues in various gateway and load-balancer configurations. There is no evidence of exploitation yet, and patches are available across the supported 14.1 and 13.1 branches.
NetScaler appliances sit at the edge of the network and broker remote access, which is exactly why they have been a favorite ransomware entry point in past years. "No known exploitation" is a window, not a guarantee, so this is a patch-soon item for anyone running one exposed to the internet.
In short: Citrix patched six NetScaler ADC and Gateway flaws, including an 8.8-rated file-read bug, with no in-the-wild exploitation reported yet.
What it means for your business: If you or your IT provider run NetScaler for VPN or remote access, schedule the update now while it is still ahead of active attacks, and note that one of the fixes also needs a config change to be fully effective.
My take: Edge appliances are the front door, and history says attackers reverse-engineer these patches fast once they are public. The gift here is timing: you have a fix and, for now, no active exploitation. That combination does not last long on internet-facing gear, so use the head start.
Source: The Hacker News: Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service
An 81-million-attempt Azure password spray slipped past MFA at dozens of firms
Huntress reported a large, automated password spray against Microsoft's Azure command-line interface that racked up more than 81 million login attempts between June 12 and 26 and compromised at least 78 accounts across 64 organizations. The uncomfortable detail is that many of the victim organizations had multi-factor authentication in place. The attackers leaned on a deprecated login method called ROPC (Resource Owner Password Credentials) that can bypass Conditional Access policies when those policies are not configured to cover it, for example when MFA is enforced only for certain apps, certain user groups, or certain locations. The campaign reused old, breached username and password pairs that had never been rotated.
In short: A password spray of 81 million attempts used a legacy OAuth flow to slip past poorly scoped MFA and take over 78 Azure accounts at 64 organizations.
What it means for your business: Check that your MFA and Conditional Access policies apply to all users, all cloud apps, and all client types rather than a subset, and rotate any credentials that show up in old breach lists.
My take: This is a "your MFA is only as good as its gaps" story. Turning MFA on is step one; the attackers here specifically hunted for the seams where it was not enforced. The unglamorous fix, blanket coverage plus killing off legacy auth flows like ROPC, is what actually closes the door.
Source: The Hacker News: Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts
The "ClickFix" scam grows a back office and serves custom malware per victim
ClickFix, the trick that fools people into infecting themselves by pasting a command after a fake "prove you're human" prompt, has professionalized. New research analyzing around 3,000 live payloads found the malicious commands are now handed out by API-driven servers that give each visitor the same malware wrapped in a different disguise. That per-victim variation is designed to defeat the signature and blocklist approaches that rely on seeing the same bad file twice, and it makes each infection harder to spot after the fact.
In short: Research on 3,000 live ClickFix payloads shows the scam now delivers uniquely disguised malware to each victim through automated APIs.
What it means for your business: Warn staff that no legitimate site asks you to paste a command into a terminal or the Run box to "verify" you, and lean on behavior-based detection rather than static blocklists for this one.
My take: ClickFix works because it turns the user into the delivery mechanism, which sidesteps a lot of technical defenses. The API-driven upgrade just makes it slipperier. The most durable control here is not a tool, it is the reflex: pasting a command you were handed by a web page is never a "human verification" step.
🧰 New software and AI tooling
Anthropic restores Claude Fable 5 worldwide after the US lifts export controls
Anthropic is bringing Claude Fable 5 back online globally. On June 30, the US Commerce Department lifted the export controls it had placed on Fable 5 and its more tightly restricted sibling Mythos 5 about two and a half weeks earlier, and Fable 5 returned to users on July 1 across Claude.ai, the Claude Platform, Claude Code, and Claude Cowork. Mythos 5 is being re-enabled for a set of approved US organizations.
For anyone who built a workflow around Fable 5 and watched it vanish mid-June, the practical lesson is less about this specific model and more about dependency: government policy can switch a core AI feature on or off with little warning.
In short: Claude Fable 5 is available worldwide again after the US lifted the export controls it imposed in mid-June, with Mythos 5 returning for select US organizations.
What it means for your business: If you depend on a specific frontier model, keep a fallback in mind, because access can change for reasons that have nothing to do with the vendor or your account.
My take: The whiplash is the story. A tool you rely on disappearing because of an export-control decision, then reappearing two weeks later, is a good argument for not hard-wiring your business to any single model. Build so you can swap the engine without rebuilding the car.
Source: The Hacker News: Anthropic Restores Claude Fable 5 After U.S. Lifts Jailbreak-Linked Export Controls
That is the AI and IT news for July 2, 2026. For yesterday's edition, see our July 1 recap, and the June 30 recap before it.