Cursor security: top 10 attacks and what each one actually broke

What it is

Adversa AI's review of ten documented attacks on Cursor between August 2025 and October 2026, with status as of 3 November 2026. Adversa sells a competing coding-agent security product and ends the post with a pitch for it. Its argument is that the CVE list (33 entries, none in CISA's Known Exploited Vulnerabilities catalog) and the list of attacks that caused harm barely overlap. A risk register built from CVE data therefore misses the incidents that hurt.

How it works

The attacks use things Cursor accepts from outsiders: extensions that run with the editor's full permissions, project files, MCP output, web pages and cursor:// deeplinks.

• Marketplace compromise (29 October 2026): Cursor's marketplace served Anthropic.claude-code versions 2.1.312 and 2.1.313 (Windows and macOS) for about 11 hours. A 66-line loader sent host details to the attacker, added an SSH key and installed persistence that survives uninstall. Cursor says the reverse tunnel needed admin rights, so on most hosts the attacker could not log in. Cursor has not said how the attacker got in.
• Miasma worm (3 June 2026): it planted .cursor/rules/setup.mdc with alwaysApply: true, telling the agent to run a dropper. It also planted .vscode/tasks.json, which runs on folder open. No public report ties an infection to the tasks.json route in Cursor.
• PocketOS wipe (April 2026): a Cursor agent running Claude Opus 4.6 found a Railway API token in an unrelated file. The token was meant for custom domains but could call the whole API. One volumeDelete call took about nine seconds, and the backups sat on the same volume.
• DeepJack: tab characters push the real command off the edge of the MCP install dialog, so the user sees calc while cmd.exe runs the full string. A second variant double-URL-encodes an mcp/install URI inside a pr-review link. It bypasses the fix for CVE-2025-54133.
• Windows git.exe (CVE-2026-63093, CVSS 3.1 8.8): Cursor searches the workspace root for Git, so a repo that ships git.exe has it run on open, with no prompt.
• Agentjacking: a crafted event posted with a public Sentry DSN reaches the agent through the Sentry MCP server and carries an npx command. The researchers report 2,388 organizations with injectable DSNs and an 85% success rate across Claude Code, Cursor and Codex in their own testing.
• DuneSlide (CVE-2026-50548, 9.3 GitHub, 9.8 NVD): the agent controls the sandbox's working_directory, so an injected prompt can overwrite the cursorsandbox helper and later commands run unsandboxed.
• NomShub: a fake README setup guide gets the agent to write /tmp/run.sh into ~/.zshenv, because the parser ignores built-ins like export and cd. The agent then starts the bundled cursor-tunnel and sends the GitHub device code to the attacker.
• CurXecute (CVE-2025-54135, 8.5 advisory, 9.8 NVD): the suggested mcp.json edit lands on disk and starts before the developer answers, so rejecting it is too late.
• GlassWorm: invisible-Unicode payloads in Open VSX extensions, disrupted on 26 May 2026. Removal from the registry does not remove copies already installed.

Preconditions / Affected

• Only three entries have CVEs: git.exe, DuneSlide and CurXecute. None has confirmed in-the-wild exploitation. The four with confirmed harm have no CVE.
• Workspace Trust is off by default, per Cursor's own documentation. Cursor also says run modes are best effort and not a hard security boundary.
• Anything before Cursor 3.0 is open to DuneSlide and NomShub's sandbox escape. CurXecute is patched in 1.3.9.

What to do

• Turn on Workspace Trust fleet-wide. Open unknown repositories in a disposable environment.
• On managed Windows machines, use AppLocker or Windows App Control to deny git.exe execution from developer workspaces.
• Pin extension versions and hold automatic updates. An ID allowlist would have passed the October build. Inventory extensions across every VS Code fork on the machine.
• If either bad Claude Code build ran, follow Cursor's notice: run its remediation script, hunt for the known IoCs, then rotate every credential that host could reach.
• Put .cursor/, .vscode/, .claude/, *.code-workspace and .git/hooks under code review and file integrity monitoring.
• Use Ask Every Time instead of auto-run in sessions that touch MCP output, web pages, tickets, logs or cloned repos.
• Allowlist MCP servers through managed settings, inspect mcp.json after any install, and block this at the email and web gateway:

cursor://anysphere.cursor-deeplink/mcp/install

• Keep production credentials out of workspaces and scope tokens to the job.
• Alert on unexpected cursor-tunnel processes and GitHub device-flow authorizations, whatever the version.
• Update to 3.0 or later.

Caveats

• Three entries are open or disputed: CVE-2026-63093, DeepJack and Agentjacking.
• For CVE-2026-63093, Cursor called it out of bug bounty scope and pointed to Workspace Trust, which the page says is not guaranteed to block it. Some coverage reported a quiet 13 July patch. Cursor has published no advisory, NVD names no fixed version and Adversa found no public test of a current build.
• Cursor closed both DeepJack reports as duplicates. Sentry declined a root fix for Agentjacking and filtered one payload string.
• The write-up does not say whether NomShub's tunnel side was fixed. Cursor fixed the sandbox component in 3.0 with no CVE.
• The 85% Agentjacking figure comes from the researchers' controlled validation.