The Cursor Bug Wasn't a Coding Error — It Was a Trust Architecture Built Backwards From the Start

When a security vulnerability lets a repository execute commands before the tool decides whether to trust it, the industry's entire model of "sandbox first, verify later" is exposed as a polite fictio