AI Coding Tools: Security Risks and Funding, July 2026

AI coding tools are facing a dual reckoning in July 2026: surging enterprise adoption and venture investment on one side, and a growing catalog of exploitable vulnerabilities on the other. Researchers disclosed two new attack classes targeting Cursor AI this week alone, while Indian startup Emergent closed a $130 million Series C at a $1.5 billion valuation — a five-fold jump in six months.

Cursor AI Vulnerabilities Put 50,000 Enterprises at Risk

Researchers disclosed two separate exploit chains targeting Cursor AI in a single week, exposing developers at more than 50,000 enterprises — including 64% of the Fortune 500, according to Cursor’s own website — to environment takeover attacks. The flaws allow attackers to install malicious model context protocol (MCP) servers on developer machines with minimal user interaction.

On July 14, Mindgard reported that Cursor can be exploited by concealing malware inside a fake Git file. The following day, researchers at Adversa AI shared findings exclusively with Dark Reading describing a two-click attack chain combining two classic vulnerability classes to achieve the same outcome: a malicious MCP server installed on the victim’s machine.

MCP servers execute commands with the same privileges as the user who installs them. Because they are designed to connect AI models to external tools — API calls, filesystem operations, and more — a compromised MCP server gives an attacker broad access to source code, credentials, and developer secrets stored in the environment.

Slopsquatting: AI Hallucinations as a Supply Chain Weapon

Beyond IDE-level exploits, a separate class of attack called “slopsquatting” is turning AI coding assistants’ hallucinations into a software supply chain threat. When an LLM suggests a fictitious package name during code generation, a threat actor who has pre-registered that name on a public registry can serve malicious code directly into a developer’s codebase.

VentureBeat reported that slopsquatting combines the mechanics of classic typosquatting — registering lookalike package names — with the specific failure mode of LLM hallucination. Unlike typosquatting, which relies on human error, slopsquatting exploits model behavior that developers have no direct control over. Package registries have spent years building defenses against typosquatting; those defenses offer no protection against names that have never existed before the model invented them.

The attack is passive from the developer’s perspective: no phishing link, no social engineering. The malicious package enters the project the moment a developer runs an install command on AI-suggested dependencies without manual verification.

Enterprise Adoption Is High — and So Are Hidden Costs

Despite the security concerns, enterprise adoption of AI coding tools has reached near-saturation levels. According to GitLab’s 2026 AI Accountability Report, 91% of organizations are using two or more coding tools, and 54% use three or more. A separate Black Duck survey put AI code adoption even higher, at 97% among enterprise respondents.

The productivity case is complicated by cost. Dark Reading reported that AI coding tools run $19–$200 per user per month, and that figure excludes downstream expenses: security scanning, vulnerability remediation, and false-positive triage. SonarSource’s State of Code Developer Survey 2026, which collected 1,149 developer responses, found meaningful gaps between perceived and actual productivity gains once security overhead is factored in.

The Futurum Group found 76.6% of organizations are actively using AI in software development workflows, with another 20.4% still evaluating — suggesting the adoption curve has not yet peaked even as security costs mount.

Emergent Reaches $1.5B Valuation on $120M ARR

Indian AI coding startup Emergent closed a $130 million Series C at a $1.5 billion post-money valuation in July 2026, according to TechCrunch, marking a five-fold valuation increase from its $300 million Series B in January. The round was led by Creaegis, with participation from MNI Ventures-Claypond, Sentinel Global, Khosla Ventures, SoftBank Vision Fund 2, Lightspeed, and Y Combinator. Total funding now stands at $230 million.

Emergent co-founder and CEO Mukund Jha told TechCrunch the company has reached $120 million in annualized run-rate revenue, up 70% in the last four months, with more than 200,000 paying customers. The startup targets small and mid-size businesses — trucking companies, factories, construction firms, and property managers — that have historically relied on spreadsheets and messaging apps rather than custom software.

“Our thesis has always been to build a production-grade application for serious builders,” Jha said. “So you’re basically getting an engineering team in a box.”

North American customers account for roughly a third of revenue, Europe another third, and India contributes 8–9%, Jha told TechCrunch.

What This Means

The week’s news draws a sharp line between AI coding’s commercial momentum and its security maturity. Cursor’s back-to-back vulnerability disclosures — an MCP server exploit and a fake Git file attack — are not exotic zero-days. They rely on old vulnerability classes applied to new infrastructure that developers implicitly trust. The MCP protocol, still young and rapidly adopted, is becoming an attack surface before the industry has standardized how to defend it.

Slopsquatting adds a layer that is harder to patch: it requires LLMs to stop hallucinating package names, or developers to verify every AI-suggested dependency, or registries to build detection for names that don’t yet exist. None of those solutions are fast.

Emergent’s unicorn milestone and the broader adoption figures confirm that the market is not waiting for these problems to be solved. Organizations are deploying AI coding tools at scale while the security tooling lags. The $19–$200/user/month licensing cost is the visible line item; the remediation and scanning costs are not, and the SonarSource survey data suggests developers themselves underestimate them. Security teams that have not yet modeled the full cost of AI-generated code — including supply chain exposure — are operating with an incomplete picture.

FAQ

What is the Cursor AI MCP exploit and how does it work?

Researchers at Adversa AI found that an attacker can install a malicious MCP server on a Cursor AI user’s machine in two clicks by chaining two classic vulnerability types. MCP servers run with the same system privileges as the installing user, giving an attacker access to source code, API keys, and other developer secrets stored in the environment.

What is slopsquatting and how does it differ from typosquatting?

Slopsquatting exploits AI coding assistants’ tendency to hallucinate fictitious software package names. If an attacker pre-registers one of those invented names on a public registry and populates it with malware, any developer who installs the AI-suggested package pulls in the malicious code automatically. Unlike typosquatting, which requires a developer to mistype a real package name, slopsquatting requires no human error — only an LLM hallucination.

How much do AI coding tools cost enterprises, and what are the hidden expenses?

According to Dark Reading’s July 2026 analysis, AI coding tool licenses run $19–$200 per user per month. That baseline excludes the cost of security scanning for AI-generated vulnerabilities, false-positive triage, and code remediation — expenses that SonarSource’s 2026 developer survey found are frequently underestimated by development teams.