I just feel like, from the POV of AI companies, that reducing the amount of em dashes they use to "blend in" more and talk more human-like, for the sake of being less detectable, wouldn't be a big priority.
The problem seems to be deeper rooted. Cursor doesn't see cloning a repo with Cursor and code execution as separate security boundaries.
Cursor ships with Workspace Trust disabled by default [0]. A repo that includes .vscode/tasks.json with "runOn": "folderOpen" will already run arbitrary code [1].
I don't think it was written by an LLM, some things stand out:
The congratulations text is both in English and Japanese. Contains a single heart emoji.
There was an intention to have a cyan to orange gradient, but the range starts in an ANSI block, ends halfway through the 256 color block and 256 terminal colors are not arranged like a gradient at all.
There's no sleep at the end of the loop where I feel like an LLM would add that defensively.
Use cases range from sending 100s of requests per second just to bring a website down to doing a montly request to a municipality's endpoint to get a local dashboard of when trash is picked up. I don't think you can pass a single judgement of automating web requests in general.
Have you considered requiring a small payment for vulnerability disclosure? Refund it on payout. This should be very effective at deterring spammers. It also sucks for real reports, but beats shutting down the program entirely.
Having their business transparent makes sense but by restricting people's personal lives like this would disincentivize good people from rising to power, which is not what we want.