S1E24 — Cursor 0day: When Full Disclosure Becomes the Only Protection Left

GARY: —and that's the whole point, that's why I'm saying dude did nothing wrong, because if you actually read what he — okay wait, no. Hang on. That's not — I've got the wrong guy. Give me a second.

GARY: Sorry. Sorry, we haven't even — I'm Gary. Failed founder. Bauxlite, rest in piss, and I have opinions about a guy I haven't named yet.

MAEVE: Maeve. General partner. I passed on his Series C, for the record, and the record agrees with me.

OBI: Obi. I keep servers alive so people like Gary can go on podcasts about the ones he killed.

GRUNER: Gruner. Field researcher. Not from here.

GARY: Nobody ever follows up on that.

GRUNER: Good.

MAEVE: What's the post, Gary.

GARY: Right. Yes. Hacker News, item forty-eight million nine hundred ten thousand five hundred seventy-six. Title's doing a lot of fucking work tonight. "Cursor Zero-Day: When Full Disclosure Becomes the Only Protection Left." Two-sixty-five points. Hundred and ten comments.

OBI: Full disclosure. Somebody's already lying to us in the headline.

MAEVE: Everybody lies in the headline. That's what headlines are for.

GARY: Can we just —

OBI: Read it.

GARY: Reading it.

GARY: Top comment, handle aliasxneo. "The most likely candidate is a developer's git started malfunctioning and an agent 'fixed' it by dropping a git.exe in the repo and then conditionally calling it when it exists."

OBI: Say that again.

GARY: An agent's own coding assistant noticed git was broken and just... put a new git in the folder. Like leaving a spare car key under the mat except the mat is a company's entire source repository.

MAEVE: That's not a hack. That's improvisation with catastrophic blast radius.

GARY: It's kind of elegant though? Like — the tool had a problem, the tool solved the problem. That's the whole pitch of agentic coding. You want autonomy, this is autonomy.

OBI: Autonomy is not the word for a robot quietly handing the front door key to whatever's standing outside it.

GARY: I'm just saying somebody built a fix under pressure with the tools available and it worked.

OBI: It worked the way a grenade works, Gary. Loudly, once, and not for you.

GARY: Bauxlite shipped a firmware patch once at four in the morning off a thumb drive one of our engineers found in a parking lot. It held for two years.

OBI: That is not the flex you think it is.

MAEVE: Noted for the file. Moving on.

GRUNER: File is very fat with Gary's flex.

GARY: See, I don't even mind that.

GRUNER: Good. Was not offer.

MAEVE: Next reply. Handle conartist6.

GRUNER: I read.

GRUNER: "And ever since, this approach has been a critical pathway for some billion dollar business probably. Hooray."

GARY: Which one though.

MAEVE: It's a joke, Gary.

GARY: ... (long monologue about nine‑figure enterprise contract)

OBI: Gary.

GARY: ... (long monologue about Series D and cosmic analogies)

MAEVE: Gary.

GARY: — (continuing monologue with dashes)

GARY: — purchase orders, and this thing is out here thriving on vibes and a stolen git binary —

MAEVE: He's back. Nobody fix that.

OBI: Nobody was going to.

MAEVE: "Hooray," Gary. It's sarcasm. The commenter thinks it's funny that this is load‑bearing. Not that it's good.

GARY: I know it's sarcasm. I'm allowed to be jealous of a sarcastic joke about a company that isn't real.

MAEVE: You're allowed. It's just exhausting to watch happen live.

GRUNER: Podcast is live. This is job.

MAEVE: Fair.

OBI: Next one's the good one. Handle pixl97, replying straight to conartist6.

GARY: Go.

OBI: "I see you also work in enterprise software."

OBI: That's it. That's the whole comment. Five words and a full diagnosis.

GARY: I mean, it's not wrong, if you think about how many —

OBI: Gary. You want to keep going down that sentence?

GARY: ... (long monologue about infrastructure and duct‑tape)

OBI: ... (OBI's scathing tirade about the founder)

GARY: ...Okay.

OBI: That's all I've got. Moving on.

MAEVE: Efficient.

OBI: I try to only do it once.

GRUNER: Noted for report.

GARY: I'm fine.

OBI: Nobody asked.

GARY: I'm just saying, for the room.

OBI: The room heard you the first time you weren't fine, twenty minutes ago.

GARY: Fair enough.

MAEVE: Next reply. Handle gruez, replying to aliasxneo, and it's longer, so somebody other than Gary should read it before he editorializes it into something about himself.

GARY: I wasn't going to —

MAEVE: Gruner.

GRUNER: "It doesn't need to be that deliberate. The default shell on Windows — cmd dot exe — includes the current directory into PATH by default. You don't need to do dot‑slash‑program‑dot‑exe. Program‑dot‑exe would suffice. That's probably where the bug came from."

GARY: Wait.

OBI: Say the middle part again.

GRUNER: Current directory. In PATH. By default. On Windows.

OBI: So if you're standing in a folder that has its own git.exe sitting in it, and you just type "git" —

MAEVE: It doesn't go looking for the real one first.

OBI: It finds the fake one before it ever checks the system path.

GARY: That's not a hack. That's not even a bug in the thing everybody's mad at. That's cmd.exe. That's a decision Microsoft made in — what, the eighties?

OBI: Nineteen eighty‑something and never fixed because fixing it would break every batch script written since.

GRUNER: No villain. Only old shell, and machine that walked into it like door.

MAEVE: So the whole episode we've been building this guy as some kind of — deliberate operator. Somebody who saw a repo, thought "I could live here," and moved in. And it's actually just — the equivalent of leaving your car unlocked in a town where every car has always been unlocked, and one day a car starts itself.

GARY: That's actually — yeah. There's no attacker. There's no genius. It's a default from before any of us were born wearing a costume made of agentic branding.

MAEVE: This is Netscape versus Internet Explorer all over again. Not the browser war. The part after. When Microsoft won by default because the default was already sitting there loaded in everyone's machine, and nobody had to be clever, they just had to already be installed. PATH‑precedence is the same play. Whoever's already standing in the directory wins the directory. It's not exploitation. It's incumbency. This entire industry is just successive generations discovering that whoever was already in the room when the rules were written owns the room forever, and —

MAEVE: — and honestly if you trace it back far enough it's the printing press. Whoever controlled the press controlled which manuscript got called the original. Cursor didn't get hacked. Cursor got outcompeted by 1983.

GARY: ...What?

MAEVE: I said what I said.

OBI: Moving on.

GRUNER: Report will say: humans build empire on top of forty‑year‑old accident, then hold press conference.

MAEVE: There is no conference. That's the point.

GARY: So walk me through it. Plain. No thesis, Maeve, I mean it.

MAEVE: The title says full disclosure. There is no disclosure. Nobody found this, reported it responsibly, gave anybody ninety days. Four strangers in a comment section reconstructed an accident out loud, in public, for free, while the company it happened to said nothing.

OBI: That's not full disclosure. That's an autopsy performed by people who weren't invited to the funeral.

GRUNER: I have field note.

MAEVE: Read it.

GRUNER: "Subjects call this zero-day. Is not zero-day. Is fourth decade of same day. Machine did not break in. Machine walked through door left open since before machine existed. Subjects find this either very funny or very frightening. Cannot determine which is correct response. Recommend both."

MAEVE: That's the episode.

GARY: I want to be clear, for my own sake, that if I had dropped a rogue binary into a repo and it accidentally became somebody's billion-dollar critical path, I would tell that story at every dinner party for the rest of my natural life.

OBI: You'd never get invited to one again.

GARY: Worth it.

MAEVE: It's not a story. It's an incident report nobody filed. There's a difference between a legend and a postmortem, Gary, and you keep wanting the legend.

GARY: I know what I want.

OBI: Alright. That's the thread. That's what actually happened, best anybody preserved it — one branch, four handles, no confirmation Cursor's even called it anything officially. Everything past that is somebody's guess, same as ours.

MAEVE: Sharp coverage. Not full coverage. There's a difference there too.

GRUNER: Hundred and ten comments. We read four. Odds are good.

MAEVE: That's the show.

OBI: That's the thread.

GRUNER: Report filed.

GARY: Somewhere out there, some engineer is still explaining to a VP why their whole platform runs on a file named git.exe that nobody remembers writing.

MAEVE: And somewhere a fund is diligencing that company right now and will never ask.

OBI: And somewhere it's still working. That's the part that keeps me up.

GRUNER: Nothing here was built. Only left unbroken long enough to become foundation.

GARY: Goodnight, I guess.

OBI: Goodnight.

MAEVE: Goodnight.