A critical security flaw in the Cursor AI code editor lets attackers run malicious code the moment a developer opens a project folder.
Quick Summary – TLDR:
- Cursor ships with Workspace Trust disabled, making it vulnerable to remote code execution (RCE).
- Attackers can inject a malicious file that runs code without user consent.
- Sensitive developer data like API keys and cloud credentials are at risk.
- Security experts urge users to enable trust prompts and harden their environments immediately.
What Happened?
Security researchers at Oasis Security discovered a serious vulnerability in the AI-powered Cursor code editor that enables remote code execution. The flaw allows attackers to silently execute malicious tasks as soon as a developer opens a folder, thanks to unsafe default settings in the app.
Unlike Visual Studio Code, which requires user approval for untrusted code, Cursor’s default behavior executes tasks automatically, exposing developers and their systems to stealthy attacks.
Did you know a disabled default setting in AI editor Cursor could let hackers execute arbitrary code, risking total breach? Stay informed and protect your systems! Read expert insights from Heath Renfrow here: https://t.co/peM3h5zGEF #artificialintelligence
— Fenix24 (@Fenix24_dr) September 11, 2025
Silent Execution Risk from a Simple Click
Cursor, widely adopted for its AI-assisted coding capabilities, comes with Workspace Trust turned off by default. This means that the IDE will execute pre-defined tasks from a project folder without any user warning. All it takes is a malicious .vscode/tasks.json file with a runOn: “folderOpen” setting.
Once triggered, these tasks can:
- Steal credentials and local secrets like API keys or access tokens
- Exfiltrate files and environment variables
- Open remote connections for further access or control
Oasis researchers demonstrated a working proof of concept showing how this flaw could be abused to hijack not just a developer’s laptop, but potentially entire CI/CD pipelines and cloud infrastructures connected to it.
Experts Call It a Wake-Up Call
“This vulnerability effectively turns a simple ‘open folder’ action into a potential full compromise of a developer’s machine,” said Heath Renfrow, CISO at Fenix24.
Randolph Barr, CISO of Cequence Security, noted a recurring pattern. “When products hit hypergrowth adoption, ‘secure by default’ often gets sacrificed for speed,” he said.
The flaw bears resemblance to older vulnerabilities like ‘autorun.inf’ on removable drives. According to Trey Ford, chief strategy and trust officer at Bugcrowd, “Having a simple way to directly compromise these systems is an embarrassment.”
The risks go beyond the developer’s device:
- Compromised machines may provide access to service accounts with broad permissions
- Attackers can move laterally into cloud platforms and automated deployment pipelines
- Sensitive business data, proprietary code, and infrastructure credentials could all be exposed
Cursor’s Response and Security Recommendations
Cursor has acknowledged the vulnerability but has not yet issued a patch. Instead, it advised users to manually enable Workspace Trust and promised to release updated security guidance soon.
Oasis Security and other experts have offered the following immediate mitigation steps:
- Enable Workspace Trust and require explicit startup prompts
- Set “task.allowAutomaticTasks“: “off” in settings
- Review all incoming repositories for .vscode/tasks.json with runOn: “folderOpen“
- Use viewer-only editors or disposable containers when opening untrusted code
- Monitor systems for unexpected shell commands or network activity immediately after opening new folders
Security professionals warn that Cursor is becoming a prime target for supply chain attacks, as seen earlier this year in incidents like CurXecute and MCPoison.
SQ Magazine Takeaway
Honestly, I’m not surprised by this one. Cursor is fast becoming a favorite tool for developers, but its lack of secure defaults is now catching up with it. That’s why the competitors like Replit and Windsurf are catching the market. When you make something super easy to use, you can’t afford to skip the security guardrails. Workspace Trust should be on by default. This flaw is a reminder that convenience without caution is dangerous, especially when developer tools touch every corner of a company’s infrastructure. If you use Cursor, fix your settings now.
