Cursor's AI coding agent morphed 'into local shell' with one-line prompt attack