Cursor writes prototype pollution flaws into your merge code

Short summary

AI code editors like Cursor and Claude Code routinely generate recursive merge helpers vulnerable to prototype pollution, where a crafted JSON payload with a __proto__ key can inject properties onto every object in your application. The root cause is that training data from old blog posts and StackOverflow answers rarely guard special keys, so models reproduce the insecure pattern. The fix is simple: skip __proto__, constructor, and prototype keys, or merge into a prototype-free structure like Object.create(null) or a Map.

• •AI editors generate recursive merge functions that are vulnerable to prototype pollution via __proto__ keys
• •Models learn from unguarded StackOverflow patterns and reproduce the missing security check
• •Fix by filtering special keys or using Object.create(null)/Map to eliminate the prototype chain

Generated with AI, which can make mistakes.