Cursor almost certainly has lots of different contexts you're not seeing as it noodles on Javascript code for you. It's just that none of those contexts are designed to express (or, rather, enable agent code to express) security boundaries. That's a problem with Cursor, not with LLMs.
What I want to push back on is anybody saying that the solution here is to better train an LLM, or to have an LLM screen inputs or outputs. That won't ever work --- or at least, it working is not on the horizon.
https://www.anthropic.com/engineering/building-effective-age...
"agent code" means, to me, the code of the LLM acting in a role of an agent.
Are we instead talking about non-agent code? As in deterministic code outside of the probabilistic LLM which is acting as an agent?