Cursor security incident