TL;DR

Cursor and Claude Code default to for...in object merge -- a CWE-1321 prototype pollution vector

Root cause: AI training data skews toward pre-2019 StackOverflow answers that predate Object.hasOwn()

One-line fix closes it entirely -- AI just never adds it unless you ask

Last week I was reviewing a side project a friend asked me to look over. Node backend, built almost entirely in Cursor. Clean structure, good variable names, even some inline comments. Genuinely readable. Then I hit the utility functions.

One was a deep merge helper. The kind every backend has -- takes two objects, recursively merges keys. AI writes these instantly.…