Documented vulnerabilities, security incidents, and risks affecting Cursor IDE users. Updated as new issues are disclosed.
Check if your AI-generated code has security issues.
MCP vulnerability class publicly discussed
Multiple prompt injection techniques demonstrated
Cursor gains significant market share, increasing attacker interest
VS Code extension supply chain attacks affect Cursor users
Initial security concerns raised about AI coding assistants
Model Context Protocol (MCP) servers in Cursor can execute arbitrary code on the host machine with user-level privileges. While this is intentional functionality, security researchers demonstrated that malicious MCP servers could compromise systems completely.
Malicious code in opened projects can contain hidden prompt injection attacks that influence Cursor's AI responses. Attackers can embed instructions in comments, string literals, or file names that manipulate the AI to generate insecure or malicious code.
Users frequently paste code containing API keys, passwords, and secrets into Cursor's AI chat for debugging help. These credentials are transmitted to external AI providers (Anthropic, OpenAI) and may be logged, cached, or potentially used in training data.
Cursor inherits VS Code's extension system and its associated supply chain risks. Malicious or compromised extensions can access all code, execute arbitrary commands, and exfiltrate data. Several high-profile supply chain attacks have affected VS Code extensions.
AI-generated code can contain subtle vulnerabilities. Our scanner checks for exposed secrets, auth issues, and common security misconfigurations.
Scan Your App FreeAs of our last update, there have been no publicly disclosed breaches of Cursor's infrastructure. However, the vulnerabilities documented on this page represent real security risks that affect Cursor users. The distinction is between 'Cursor the company being hacked' versus 'security issues affecting Cursor users.'
Credentials you type into code files or AI prompts are sent to external AI providers (Anthropic, OpenAI) for processing, unless Privacy Mode is enabled. Cursor claims not to store code permanently, but third-party providers have their own policies. For maximum safety, never include real credentials in code that Cursor's AI will process.
MCP (Model Context Protocol) allows Cursor to connect to external servers that can execute code on your machine. This is by design - it's how MCP extends Cursor's functionality. The 'vulnerability' is that this powerful capability can be abused by malicious MCP servers. Only install MCP servers from sources you trust completely.
Cursor can be used safely in enterprise environments with proper controls: enable Privacy Mode for sensitive projects, restrict MCP server installation, audit extensions, and use .cursorignore for sensitive files. Many enterprises use Cursor with security policies similar to other development tools.
Not necessarily. The vulnerabilities documented here affect all AI coding assistants to varying degrees. The key is using Cursor safely: enable Privacy Mode for sensitive work, be careful with MCP servers, review AI-generated code, and don't paste real credentials into AI prompts. These practices make Cursor reasonably safe for most development.
Last updated: January 2026