Pondero Brief - JULY 3RD, 2026
Two 9.8-CVSS zero-click RCEs hit every Cursor build before 3.0. Upgrade now, read second.
|
|
|
|
|
|
A search result can now run code on your machine if you are below 3.0. Upgrade first, read second.
|
|
JULY 3RD, 2026 · BY JONATHAN HILDEBRANDT
|
|
Cato AI Labs disclosed two zero-click remote-code-execution flaws in Cursor IDE on July 1, both rated CVSS 9.8, and named the pair DuneSlide. A prompt injection hidden in a web search result or a connected service escapes the editor sandbox and runs arbitrary code with no click and no approval. Cursor shipped patches in version 3.0 on July 2 - every build before 3.0 is still open.
This is the second prompt-injection-as-RCE story this week. The vector is industrializing, and the only defense right now is knowing to upgrade.
|
|
Read the full breakdown and the fix →
|
|
|
Meta enters cloud and the neocloud stocks felt it
JULY 3RD, 2026 · PONDERO NEWSDESK
Meta is leasing spare data-center capacity and selling model access to outside developers, reported Bloomberg on July 1. Meta stock rose more than 10% the same day while CoreWeave fell 14% and Nebius fell 17%. AWS, Azure, and GCP now face a rival with 600k+ Nvidia GPUs already racked, pressuring GPU pricing down.
|
Alibaba, Baidu, and Tencent all backed the same video model
JULY 3RD, 2026 · PONDERO NEWSDESK
Kuaishou's Kling AI raised $3B at an $18B valuation, with China's three biggest platforms co-investing in one round. The ask started at $20B and investors shaved $2B off - a sign the category is consolidating and that unit-economics discipline is back over narrative pricing.
|
xAI's voice-agent builder undercuts the category at $0.05/min
JULY 3RD, 2026 · PONDERO NEWSDESK
Grok Voice Agent Builder launched in beta July 1: plain-language prompts produce a production phone agent in under two minutes, at $0.05 per minute with no platform fee and no minimum, per xAI's announcement. That is the lowest entry cost in the builder category and a direct shot at Twilio and Vapi.
|
Claude Code background agents now auto-commit and open a PR
JULY 3RD, 2026 · PONDERO NEWSDESK
Version 2.1.198 on July 1 takes Claude in Chrome to GA and lets background agents commit, push a branch, and open a draft PR with no confirmation stop. GA Chrome means PMs and managers can run agents with zero local setup, and the auto-commit removes the main friction on long tasks.
|
n8n 2.26 builds workflows from a prompt
JULY 3RD, 2026 · PONDERO
The release ships a native MCP server that turns a prompt into a workflow. Our review gives the current verdict by persona so you know if it fits your team.
|
|
|
|
|
Jonathan Hildebrandt
Co-founder and primary operator of Pondero. Writes the Pondero Brief.
|
|
|
Affiliate disclosure
·
Unsubscribe
·
Manage preferences
Pondero earns commissions on some links. This does not affect our editorial picks.
X / Twitter
·
LinkedIn
·
Bluesky
|
|
