A Cursor Sandbox Escape Shows Why AI Agents Need Kernel Boundaries | Dark Hacker News