Cursor.exe or child process accessing SSH keys/cloud tokens post folder-open

Ethan Andrews@eandrews

•updated Jul 15, 2026•1•0•2

Detects the Cursor IDE (Cursor.exe) or its child processes accessing sensitive SSH private key files or cloud provider authentication credentials. This behavior is indicative of a compromised IDE process, potentially leveraging malicious extensions or MCP (Model Context Protocol) servers to exfiltrate secrets from the local filesystem.