PSA: Inviting a single user to your org in Cursor does NOT create a single-use invite!

The generated code/link is pervasive, and can be used by attackers who can subsequently use it to get an account in your org and rack up a big bill.

Cursors response: the usage is "valid". Tough.

I guess this halts our (~50 Devs) companies' trial with Cursor.

Are they vibe-coding their own product? Correct me if I'm wrong, but this a HUGE mis-implementation of the invite system? They don't even support MFA or send notification emails when someone uses the link to sign up to your team.