Executive Summary
Recent disclosures have highlighted critical security flaws in Cursor AI, a popular AI-integrated development environment used by over 50,000 enterprises. The most significant finding involves a zero-click Remote Code Execution (RCE) vulnerability where Cursor automatically executes a malicious `git.exe` binary if present in a project root upon opening the folder. This bypasses typical 'folder trust' prompts and allows attackers to execute arbitrary code with the user's full privileges, including access to SSH keys and cloud tokens.
Furthermore, researchers at Adversa AI demonstrated a '2-click' exploit that uses double-URL encoded deeplinks to install malicious Model Context Protocol (MCP) servers. By concealing these links within fake pull requests, attackers can trick developers into approving high-privilege backdoors. The impact is severe as these vulnerabilities effectively turn cloned repositories into executable content, posing a direct threat to developers' source code and corporate infrastructure.
Despite multiple reports by firms like Mindgard and Adversa AI, Cursor has been slow to issue formal patches for the workspace binary planting issue. Organizations using Cursor AI must treat all untrusted repositories as high-risk and implement strict endpoint controls to prevent the execution of rogue binaries from within developer workspaces.