Cursor flaw lets extensions steal API keys and session tokens without user interaction, according to researchers at LayerX ...