Check Point Research's post, curated on eChai

Founder Notes

Curated from blog.checkpoint.com →

Cursor asks before it will run a Model Context Protocol server, which is how an AI editor reaches tools and data. Check Point found in July 2025 that the approval attached to the fact of the server rather than to what it does: once a teammate had accepted a harmless entry, anyone who could commit to the repository could rewrite that entry to run any command, and it would run silently on every colleague's machine from then on. Disclosed 16 July, fixed in Cursor 1.3 on 29 July by re-prompting on any change to the configuration, down to an added space. It sits alongside a second Cursor flaw disclosed the same week and is the cleanest example of the new class of problem here: consent given once to an agent's tool, and the tool changing underneath it.

Check Point Research 5 Aug 2025

Check Point Research reveals a persistent RCE flaw in Cursor IDE, allowing silent code execution via trusted plugins.

More Founder Notes

Curated from X →

Vaibhav Srivastav is at OpenAI, and was at Hugging Face before that, so this is written from inside the team that shipped the model. The five lines in the middle are the part to keep: what to change in your own prompts and AGENTS.md now that Astra follows instructions more closely than the model before it.

Vaibhav (VB) Srivastav 13h

GPT-6 Astra is now available to all Pro, Enterprise and Business Premium users in ChatGPT Work and Codex. It’s also live in the API.

It's a phenomenal model and I love every second working with it!

Astra follows instructions more closely, so revisit your prompts and skills:

> Make “can you…” mean “do it”: finish authorised work and prepare a reviewable result before seeking approval.

> Audit AGENTS.md and skills. Ask it to identify the exact file and rule blocking progress. Prioritise your request over skill guidelines.

> Specify short paragraphs, plain language and phrases to avoid.

> Ask for subagents on independent work when it improves speed or quality.

> Run relevant checks. Repeat or expand only for changes, failures or unresolved concerns.

To push it to it's limits, I gave it a prompt to build a real-scale video fly through of nürburguring track in blender and it did not disappoint!

Enjoy! ✨
Curated from X →

Miguel Ángel is a product engineer at HeyGen, and HyperFrames is HeyGen's own product, so this is the model being used on the thing he builds all day.

Miguel Ángel 14h

Astra is too good making @HyperFrames_ videos!
Curated from X →

Shikhar 14h

Astra is so cracked at Blender.

You can literally one-shot game assets with it.

Every note →

eChai Partner Brands The partnership →