What goes wrong
Most serious findings against Cursor share one pattern: configuration the agent or a repository can write, which Cursor then runs. The main risks are:
- Repository configuration: a project’s
.cursor/folder widens the sandbox, extends your allowlists, or adds MCP servers and hooks. - Turned-off protections: Run Everything, a disabled sandbox or a broad allowlist on a machine that holds credentials.
- Sandbox escapes: paths, symlinks and git hooks that let a sandboxed command act outside it.
- Injected instructions: issues, messages, rules files and MCP output steer the agent.
- Extension supply chain: MCP servers and Open VSX extensions are third-party code running with your rights.