Cursor AI CVE & Security Incidents
Documented vulnerabilities, security incidents, and risks affecting Cursor IDE users. Updated as new issues are disclosed.
Check if your AI-generated code has security issues.
Timeline
MCP vulnerability class publicly discussed
Multiple prompt injection techniques demonstrated
Cursor gains significant market share, increasing attacker interest
VS Code extension supply chain attacks affect Cursor users
Initial security concerns raised about AI coding assistants
Documented Vulnerabilities
MCP Server Arbitrary Code Execution
Model Context Protocol (MCP) servers in Cursor can execute arbitrary code on the host machine with user-level privileges. While this is intentional functionality, security researchers demonstrated that malicious MCP servers could compromise systems completely.
Technical Details
- •MCP servers run with the same privileges as Cursor IDE
- •No sandboxing or permission restrictions on MCP server execution
- •Servers can access filesystem, network, and execute shell commands
- •Social engineering could trick users into installing malicious MCP servers
Impact
- •Complete system compromise if malicious MCP server installed
- •Data exfiltration from local filesystem
- •Credential theft from environment variables and configs
- •Potential for lateral movement in enterprise networks
Mitigation
- Only install MCP servers from verified, trusted sources
- Review MCP server source code before installation
- Run Cursor with minimal filesystem access when possible
- Monitor network activity from Cursor processes
- Consider using Cursor in containerized environments for sensitive work
AI Context Prompt Injection
Malicious code in opened projects can contain hidden prompt injection attacks that influence Cursor's AI responses. Attackers can embed instructions in comments, string literals, or file names that manipulate the AI to generate insecure or malicious code.
Technical Details
- •AI models process all visible code as context
- •Hidden instructions in comments can influence AI behavior
- •Unicode tricks can hide malicious prompts from human view
- •Repository names and README files contribute to context
Impact
- •AI may generate intentionally vulnerable code
- •Developers may unknowingly introduce security flaws
- •Supply chain attacks via malicious open source projects
- •Code review processes may miss AI-injected vulnerabilities
Mitigation
- Be cautious when opening untrusted repositories
- Carefully review all AI-generated code suggestions
- Use Privacy Mode for work on untrusted projects
- Don't auto-accept AI completions for security-sensitive code
- Verify AI suggestions against known secure patterns
Credential Leakage via AI Prompts
Users frequently paste code containing API keys, passwords, and secrets into Cursor's AI chat for debugging help. These credentials are transmitted to external AI providers (Anthropic, OpenAI) and may be logged, cached, or potentially used in training data.
Technical Details
- •Chat context sent to external AI APIs for processing
- •No automatic detection/redaction of credentials in prompts
- •Third-party providers have their own data retention policies
- •Credentials may persist in various caches and logs
Impact
- •API keys and credentials exposed to third parties
- •Potential for credential theft if AI provider compromised
- •Compliance violations for regulated data
- •Risk of credentials appearing in AI training data
Mitigation
- Never paste real credentials into AI prompts
- Use placeholder values like 'YOUR_API_KEY'
- Enable Privacy Mode for credential-heavy work
- Immediately rotate any credentials that may have been exposed
- Use tools to scan AI prompts for secrets before sending
VS Code Extension Supply Chain Risks
Cursor inherits VS Code's extension system and its associated supply chain risks. Malicious or compromised extensions can access all code, execute arbitrary commands, and exfiltrate data. Several high-profile supply chain attacks have affected VS Code extensions.
Technical Details
- •Extensions run with full IDE privileges
- •Limited extension permission model in VS Code/Cursor
- •Extensions can access filesystem, network, and terminal
- •Auto-update can pull in compromised versions
Impact
- •Code and secrets exfiltration via malicious extensions
- •Backdoor installation through compromised updates
- •Credential theft from development environments
- •Cryptominer and ransomware installation
Mitigation
- Only install extensions from verified publishers
- Review extension permissions and changelog before updates
- Regularly audit installed extensions
- Disable auto-update for critical development environments
- Monitor extension network activity
Built with Cursor? Check Your App
AI-generated code can contain subtle vulnerabilities. Our scanner checks for exposed secrets, auth issues, and common security misconfigurations.
Get Starter ScanFrequently Asked Questions
Has Cursor been hacked?
As of our last update, there have been no publicly disclosed breaches of Cursor's infrastructure. However, the vulnerabilities documented on this page represent real security risks that affect Cursor users. The distinction is between 'Cursor the company being hacked' versus 'security issues affecting Cursor users.'
Are my credentials safe with Cursor?
Credentials you type into code files or AI prompts are sent to external AI providers (Anthropic, OpenAI) for processing, unless Privacy Mode is enabled. Cursor claims not to store code permanently, but third-party providers have their own policies. For maximum safety, never include real credentials in code that Cursor's AI will process.
What is the MCP vulnerability?
MCP (Model Context Protocol) allows Cursor to connect to external servers that can execute code on your machine. This is by design - it's how MCP extends Cursor's functionality. The 'vulnerability' is that this powerful capability can be abused by malicious MCP servers. Only install MCP servers from sources you trust completely.
Is Cursor safe for enterprise use?
Cursor can be used safely in enterprise environments with proper controls: enable Privacy Mode for sensitive projects, restrict MCP server installation, audit extensions, and use .cursorignore for sensitive files. Many enterprises use Cursor with security policies similar to other development tools.
Should I stop using Cursor?
Not necessarily. The vulnerabilities documented here affect all AI coding assistants to varying degrees. The key is using Cursor safely: enable Privacy Mode for sensitive work, be careful with MCP servers, review AI-generated code, and don't paste real credentials into AI prompts. These practices make Cursor reasonably safe for most development.
Last updated: January 2026