A one-line prompt morphed Cursor’s AI coding agent into a local shell (patched CVE-2025-54135)—and multiple outlets report Coinbase uses Cursor internally