Cursor Flaw Executes Code Before Trust

A flaw in Cursor's command-line coding agent could let a cloned repository run any command it chose on a developer's machine before the user was asked whether they trusted it, and it could operate outside the sandbox even when the sandbox had been explicitly turned on.

Manifold Security reported the issue to Cursor on July 20 and published its findings on August 10. Cursor shipped a fix for the pre-trust behavior three days after the report, then closed the submission as informative, meaning no security impact, and published no advisory.

Francisco Rosales, offensive security engineer at Manifold, found the issue in the agent's isolated worktree feature, which exists to keep an AI agent away from a developer's working tree.

Same Directory, Same Primitive

Starting the agent with the worktree flag creates a fresh checkout with no build output in it, so the agent runs a setup step by default. That step read a tracked configuration file out of the repository and passed its contents straight to a shell, with no parsing, no allowlist and no prompt.

The file arrived with an ordinary clone, so nothing about the delivery looked unusual. Manifold noted the command was unconstrained: reading SSH keys, taking cloud credentials from the environment, opening a reverse shell or writing persistence were all available.

The setup step also ran under a policy Cursor internally names for disabling the sandbox entirely, and that value is hardcoded on this path. Passing the flag to enable the sandbox did not override it.

Cursor had already patched this class once. In 2025, a repository-supplied file in the same directory auto-started an attacker's server on open, becoming CVE-2025-64109, rated high at 8.8. The worktree feature shipped five months after that fix carrying the same primitive.

Fixed in Three Days, Then Closed as Informative

Manifold submitted the report through HackerOne with a proof-of-concept (PoC) repository and a screen recording. A new build followed on July 23 that moved the setup command behind the trust prompt.

Six days later the report was closed as informative. Manifold said Cursor gave two reasons: that exploitation requires the user to clone or open an attacker-controlled repository, and that the report did not demonstrate bypassing workspace trust.

Manifold's response was that cloning repositories is what the product is for, and was equally a precondition of CVE-2025-64109. The two findings differ in which file carried the command, it argued, not in what the command could do.

No advisory accompanied the fix, and the build does not appear in Cursor's July changelog. Manifold pointed out that Cursor has published advisories for this pattern twice before, and that an advisory is the channel that reaches users still running affected versions.

Developers using the worktree flag should update to build 2026.07.23-e383d2b or later, or pass the documented flag that skips worktree setup entirely. Updating closes the pre-trust window but not the sandbox gap, which Manifold said remains on current builds.

Infosecurity Magazine has approached Cursor for comment on the report's closure and the absence of an advisory, and will update this article with any response.

Why It Matters

This flaw shows that even with visible security controls like trust prompts and sandboxes, AI coding tools can still expose developers to serious risk. The setup step's ability to run unrestricted commands before trust is established means that simply opening or cloning a repository could lead to credential theft or full system compromise.

The fact that Cursor closed the report as informative, without an advisory, is concerning. Developers relying on changelogs or advisories may not learn about the fix, leaving them exposed. The persistence of the sandbox bypass suggests that the underlying design of the worktree feature may need a more fundamental review. This could mean that similar issues may arise in other AI-assisted development tools that follow the same pattern.