Cursor AI Code Editor (versions before 3.0)

Cursor's sandbox is supposed to restrict the AI agent's terminal commands to the current working directory. However, when a non-default value is assigned to the working_directory parameter, that path gets added to the system's allow list without proper validation. This means an attacker-controlled value can expand the sandbox boundary to include locations outside the project — locations the developer never intended the AI to touch.

An attacker embeds a malicious payload inside content that Cursor's AI agent is asked to read — for example, inside a file, a prompt, or a connected MCP server request (a type of external service integration). The injected instruction tells the AI to set its working directory to an attacker-chosen path. From there, the attacker can overwrite Cursor's own sandbox executable, meaning all subsequent commands run outside any sandbox restrictions entirely. The attacker achieves full remote code execution (the ability to run arbitrary commands on your machine) without ever needing direct access to your system.

• Check application logs for unexpected changes to the working_directory parameter, particularly paths outside your active project folder.
• Monitor for modifications to the cursorsandbox executable on disk — changes to this file outside of an official update are a strong indicator of compromise.
• Look for unusual outbound network connections originating from Cursor's process, especially to unfamiliar external addresses.

1. Update Cursor to version 3.0 or later immediately — patches for this flaw were included in that release.
2. Until updated, avoid opening or ingesting files from untrusted or external sources inside Cursor.
3. Review any MCP server integrations connected to your Cursor installation and remove any you did not explicitly configure.