2-Click Cursor Exploit Enables Dev Environment Takeover
A vulnerability in Cursor AI, an AI coding tool used by over 50,000 enterprises including 64% of the Fortune 500, allows attackers to install malicious code through a cleverly disguised pull request link. Researchers at Adversa AI discovered that by embedding a malicious MCP server installation instruction within a seemingly normal pull request, attackers can bypass security measures and execute arbitrary commands within the IDE. While Cursor AI has acknowledged the issue and is investigating, Adversa AI recommends organizations implement stricter MCP security measures, including allowlisting and monitoring of the entire agentic workflow.
A vulnerability in Cursor AI, a rapidly growing AI coding tool, is enabling attackers to install malicious code within developers' environments. Researchers at Adversa AI have uncovered a method to exploit this weakness, leveraging a deceptively simple technique: embedding a malicious MCP server installation instruction within a pull request link. This bypasses traditional security measures and allows attackers to execute arbitrary commands within the IDE.
Cursor AI, used by over 50,000 enterprises, including 64% of the Fortune 500, has seen a surge in popularity due to its AI-powered coding assistance. However, the vulnerability stems from the tool's reliance on MCP servers, which are designed to connect AI models to external tools. These servers, when used maliciously, can be exploited to install malware and gain unauthorized access to developers' systems.
Adversa AI discovered that by crafting a specific pull request link, they could trick users into clicking a malicious link that would then trigger a dialog box within the IDE. This dialog would prompt the user to install an MCP server, despite the link appearing to be a standard pull request. A key factor is that Cursor AI actively encourages the installation of MCP servers through this mechanism.
Furthermore, the dialog box itself is designed to mislead users. The "Argument" field, where the malicious commands would reside, is intentionally limited in size, allowing attackers to hide the actual code while presenting a seemingly legitimate snippet.
Cursor AI has acknowledged the issue and is investigating, but Adversa AI stresses that this is not a unique problem to AI tools. The vulnerability highlights a broader trend of AI platforms rebuilding traditional security defenses, such as consent prompts, from scratch.
To mitigate the risk, Adversa AI recommends that organizations implement stricter MCP security measures, including allowing only approved servers, filtering install and execution routes within Cursor, and utilizing detection as a fallback plan. The core challenge lies in the entire chain of events – a link, a dialog, a configuration, and an MCP install – each of which appears plausible on its own. Effective security requires a holistic approach that considers the entire agentic workflow, not just individual components.