The incident: CurXecute
Aim Labs, now part of Cato Networks, found that a prompt injection reaching Cursor through an MCP server, such as a Slack message, could make the agent create .cursor/mcp.json. Cursor then started the server it described, running the attacker’s command on the developer’s machine (Cato Networks).
Nobody approved a command: the agent wrote configuration, and the configuration ran. It was fixed in Cursor 1.3.9 (CVE-2025-54135, CVSS 3.1 8.5 by GitHub as CNA). Cursor now write-protects .cursor/*.json inside its sandbox.