securityrcecoding-agents Cursor on Windows runs git.exe from a cloned repo with zero clicks Opening an untrusted repo in Cursor on Windows auto-runs a git.exe planted at the repo root — zero-click RCE. Here's the flaw and what to lock down.