[pennomi]

Cursor is also vulnerable to prompt injection through third-party content.

[verdverm]

this is one reason to favor specialized agents and/or tool selection with guards (certain tools cannot appear together in a LLM request)