Cursor AI is facing serious security concerns after researchers revealed flaws that allow attackers to steal credentials and silently execute code on developer machines.
Quick Summary – TLDR:
- High severity flaws in Cursor AI expose API keys and session tokens to malicious extensions.
- Attackers can silently execute code using Git based techniques with no user interaction.
- Vulnerabilities stem from poor credential storage and weak extension isolation.
- No full fix released yet, leaving developers at ongoing risk.
What Happened?
Security researchers from LayerX and Novee uncovered multiple vulnerabilities in Cursor, an AI-powered development tool. These flaws allow attackers to steal sensitive credentials and even execute code on developer systems without warning. Despite disclosure in early 2026, key risks remain unpatched.
BREAKING: Cursor AI flaw lets any installed extension steal API keys and session tokens from an unprotected local SQLite database, CVSS 8.2, no patch as of April 28 2026.https://t.co/YIIao2cC10
— ThreatCluster (@threatcluster) April 29, 2026
Weak Security Design Exposes Credentials
One of the most critical issues, informally called CursorJacking, comes from how Cursor handles sensitive data. Instead of using secure storage systems like macOS Keychain or Windows Credential Manager, the platform stores API keys and session tokens in a local unencrypted SQLite database.
This database sits in a predictable location on the user’s system. More importantly, Cursor does not enforce proper isolation between extensions and internal data.
That means:
- Any installed extension can access the database.
- No special permissions or approvals are required.
- Credentials are stored in plain text, making extraction easy.
Attackers can exploit this by publishing seemingly harmless extensions such as themes or productivity tools. Once installed, these extensions quietly pull sensitive data and send it to remote servers controlled by the attacker.
Because the process uses legitimate extension behavior, users receive no warnings, making detection extremely difficult.
How the Attack Works?
The exploitation process is simple and scalable:
- A malicious extension is uploaded to the marketplace.
- A developer installs it without suspicion.
- The extension accesses the local database automatically.
- API keys and session tokens are extracted in plain text.
- Data is silently transmitted to an attacker controlled server.
This creates a powerful attack path with serious consequences.
Real World Impact on Developers
The stolen credentials can be used for far more than just accessing Cursor. Developers often connect high value services to their environments, increasing the damage potential.
Key risks include:
- Financial losses from unauthorized API usage on platforms like OpenAI or Anthropic.
- Exposure of sensitive code, prompts, and proprietary data.
- Unauthorized access to cloud systems and backend services.
- Full user impersonation, enabling deeper attacks across connected platforms.
Since developer environments often act as gateways to larger systems, a single compromise can quickly escalate into a broader security breach.
AI Agent Behavior Enables Silent Code Execution
A separate but equally concerning issue, tracked as CVE-2026-26268, shows how Cursor’s AI agent can unintentionally help attackers execute code.
This vulnerability does not come from a typical software bug. Instead, it arises from how the AI agent interacts with Git when working with untrusted repositories.
Attackers combine two legitimate Git features:
- Git hooks, which run scripts automatically during actions like commits.
- Bare repositories, which can be hidden inside other projects.
A malicious repository can include a hidden hook that executes code when the AI agent performs routine actions like checkout.
In traditional workflows, developers might notice unusual behavior. But Cursor’s AI agent automatically runs commands based on user prompts, reducing visibility and removing the need for direct user action.
For example, a simple request like reviewing a repository can trigger hidden scripts without the developer realizing it.
Expanding Risks in AI Development Tools
These findings highlight a growing concern in cybersecurity. AI-powered tools increase efficiency, but they also expand the attack surface.
In this case:
- Extensions are not properly sandboxed.
- Sensitive data is not securely stored.
- AI agents execute actions without enough transparency.
Researchers stress that developer environments must now be treated as high value targets, especially as AI tools gain more control over workflows.
Vendor Response and Current Status
LayerX disclosed the credential theft issue to Cursor on February 1, 2026. Cursor responded on February 5, stating that extensions operate within the same trust boundary as local applications and that users are responsible for vetting them.
As of April 2026:
- No major architectural fix has been released.
- Risks related to credential exposure remain.
- Developers are advised to take precautions manually.
The code execution vulnerability was disclosed separately and addressed, but it still highlights deeper design concerns in AI driven systems.
What Developers Should Do Now?
Until stronger protections are introduced, experts recommend immediate precautions:
- Avoid installing untrusted extensions.
- Rotate API keys frequently and monitor usage.
- Use limited scope and rate restricted keys.
- Store credentials outside local applications where possible.
- Monitor network activity for suspicious connections.
SQ Magazine Takeaway
I think this situation is a wake up call for anyone relying on AI coding tools. Cursor is powerful, but these flaws show how quickly convenience can turn into risk. When extensions can quietly steal keys and AI agents can trigger hidden code, the line between productivity and vulnerability becomes very thin. Developers need to stay cautious, and platforms like Cursor must step up their security design before trust is lost.
