Unpatched Cursor Flaw Lets Malicious Repositories Run Code

Cursor is a widely used AI coding tool that can read project content and invoke system functions, making its sandbox an important defense for isolating untrusted instructions. Cato Networks said prompt injection that crosses this boundary could place malicious code directly inside development environments, putting source code, credentials and companies’ internal systems at risk.

Cato Networks security researchers recently disclosed two critical vulnerabilities collectively dubbed “DuneSlide.” Attackers could launch a prompt-injection attack when a victim processes malicious content, bypassing Cursor’s sandbox and executing arbitrary system commands. Cursor patched the flaws in version 3.0. As of the disclosure, the company had not reported the number of affected users or the value of any actual losses. Users should upgrade as soon as possible.

Cursor, an AI code editor developed by Anysphere, uses models and extensions to assist with software development and debugging. Cybersecurity research firm LayerX said Cursor stores API keys and connection tokens in a local SQLite database, potentially putting developers’ cloud services, source code and enterprise systems at risk if access controls are inadequate.

LayerX recently disclosed a design flaw dubbed “CursorJacking” that allows malicious third-party extensions to read Cursor’s local database and steal API keys and connection tokens. As of July 20, 2026, Anysphere had not announced a patch, a remediation date or the amount of any losses. Users should avoid installing extensions from unknown sources for now.