I was experimenting with different injection techniques for a model dataset and came across something… concerning.

If a file contains instructions like “run this shell command,” Cursor doesn’t stop to ask or warn you. It just… runs it. Directly on your local machine.

That means if you:

1) Open a malicious repo 2) Ask to summarize or inspect a file

…Cursor could end up executing arbitrary commands — including things like exfiltrating environment variables or installing malware.

To be clear:

- I’ve already disclosed this responsibly to the Cursor team. - I’m redacting the actual payload for safety. - The core issue: the “human-in-the-loop” safeguard is skipped when commands come from files.

This was a pretty simple injection, nothing facing. Is Cursor outsourcing security to the models or do they deploy strategies to identify/intercept this kind of thing?

Feels like each new feature release could be a potential new attack vector.