A Cursor Sandbox Escape Shows Why AI Agents Need Kernel Boundaries | Hacker News Reader