Common Cursor Misconfigurations

Run Everything on a machine that holds credentials.

Why it matters. Run Everything runs every tool call with no sandbox and no review (Cursor docs), so one injected instruction becomes a command with your permissions.

Fix. Use Auto-review, or Allowlist with the sandbox on. Keep Run Everything for disposable containers.

Workspace Trust left off (the default), so every folder's .cursor/ configuration applies.

Why it matters. Cursor ships with Workspace Trust "disabled by default" (Cursor docs). A project's sandbox.json takes priority over yours, its permissions.json is concatenated with yours, and its hooks run in any trusted workspace (sandbox.json, permissions.json, hooks).

Fix. Set security.workspace.trust.enabled to true, open unknown folders in restricted mode, and read .cursor/ before trusting them.

Cursor not updated.

Why it matters. Recent advisories fixed a sandbox escape through a tampered Python virtual environment (CVE-2026-73217, fixed in 3.1.2), the DuneSlide sandbox escapes, which NVD scored 9.8 (CVE-2026-50548 and CVE-2026-50549, fixed in 3.0), and NomShub, a macOS sandbox breakout through shell builtins (Straiker, fixed in 3.0). A macOS escape through privileged Docker containers had no fix at publication (GHSA-v4xv-rqh3-w9mc).

Fix. Install updates as soon as they are offered, and follow Cursor's security advisories. On macOS, don't give the agent a Docker socket.

A sandbox turned off or opened up in sandbox.json.

Why it matters. insecure_none disables the sandbox, networkPolicy.default: "allow" lets sandboxed commands reach any host, and extra paths widen what they can read and write (Cursor docs).

Fix. Keep workspace_readwrite, deny the network by default with a short allow list, and give the sandbox no home or credential paths.

Shells, interpreters, deletes or network tools in the terminal allowlist, or *:* in the MCP allowlist.

Why it matters. Allowlisted calls run without asking, outside the sandbox, and Cursor says allowlists "are not a security guarantee" (Cursor docs).

Fix. Allowlist only read-only commands such as git status and git diff, and specific read-only MCP tools.

Project or user MCP configuration that the agent, or a repository, can write.

Why it matters. CurXecute used a prompt injection, delivered through an MCP-connected Slack message, to create .cursor/mcp.json and run commands (CVE-2025-54135, fixed in 1.3.9). MCPoison showed that "Once an MCP is approved, future modifications to its command or arguments are trusted" (CVE-2025-54136, fixed in 1.3).

Fix. Keep Cursor current, read every .cursor/mcp.json before trusting a folder, and keep MCP servers on an approved, pinned list.

MCP servers that read content outsiders can write, with broad tools.

Why it matters. Fake Sentry error events carrying "fix" instructions hijacked Cursor, Claude Code and Codex through an MCP server (Agentjacking, The Hacker News).

Fix. Give these servers read-only scopes, keep their tools out of the allowlist, and read what they return before acting on it.

Opening repositories that carry git hooks or program-running git settings.

Why it matters. Novee showed a nested bare repository with a malicious pre-commit hook running code outside Cursor's sandbox (CVE-2026-26268, fixed in 2.5).

Fix. Keep Cursor current, re-clone repositories that arrived as archives or folders, and check .git/config for core.hooksPath and core.fsmonitor.

Rules files merged without review.

Why it matters. Pillar Security hid instructions in rules files with zero-width and bidirectional characters that steered Cursor and Copilot; Cursor said the issue "falls under the users' responsibility" (Pillar Security).

Fix. Put .cursor/rules/, .cursorrules and AGENTS.md under CODEOWNERS and add a pre-commit check for hidden Unicode.

Symlinks with harmless names pointing at agent configuration or dotfiles.

Why it matters. Adversa showed approval prompts in five coding agents, Cursor among them, displaying the harmless link name while the write landed on the real target (Adversa, SymJack), and DuneSlide used a symlink and failed path canonicalisation to escape the sandbox (Cato Networks).

Fix. List links and their targets before trusting a repository, and delete links you didn't create.

The Cursor CLI in unrestricted mode, with its sandbox off, broad allow rules, or a --yolo alias.

Why it matters. --force and its alias --yolo allow every command unless explicitly denied, and --approve-mcps approves every MCP server (Cursor CLI docs).

Fix. Use allowlist or auto-review approval with the sandbox on, deny .env reads, and remove the aliases.

Extensions installed from Open VSX without checking the publisher.

Why it matters. A fake "Solidity Language" extension on Open VSX cost a blockchain developer about $500,000 (Kaspersky).

Fix. Install extensions only from an organisation allowlist and verified publishers; Enterprise teams can enforce allowed extensions.

Hooks that fail open, or hooks from someone else.

Why it matters. Crashes, timeouts and non-zero exit codes other than 2 "fail open by default", and project hooks run for everyone in a trusted workspace, including cloud agents (Cursor docs).

Fix. Set failClosed: true on security hooks, and read every project hook before trusting the folder.

.cursorignore treated as a way to hide secrets.

Why it matters. "The terminal and MCP server tools used by Agent cannot block access to code governed by .cursorignore", and Cursor calls it "not a security boundary" (Cursor docs). A new .cursorignore could also invalidate existing ones before 2.0 (CVE-2025-64110).

Fix. Keep secrets out of the workspace and out of git, and use the sandbox and CLI deny rules for credential files.

Secrets written into mcp.json.

Why it matters. Anything that can read the file can read the secret. Cursor supports ${env:NAME} so the value stays out of it (Cursor docs).

Fix. Pass secrets as ${env:NAME}.

Cloud agents with "Allow all" network access, or broad secrets.

Why it matters. "The agent has internet access by default", and secrets in a cloud agent environment are "still visible to users... via the Terminal" (Cursor cloud agent docs).

Fix. Use "Default + allowlist" or "Allowlist only" network access, give environments only the secrets a task needs, and review environment.json.

An editor engine left behind on old Chromium releases.

Why it matters. In October 2025, OX Security found that Cursor's bundled Chromium was last updated in early 2025 and counted at least 94 known CVEs published since (OX Security).

Fix. Keep Cursor current, and treat untrusted web content in the editor's browser features with the same care as in an old browser.

On Windows, C:\ProgramData\Cursor missing or writable by standard users.

Why it matters. Cymulate showed that a standard user can create the folder and plant a hooks.json that loads for every Cursor user on the machine; it was unresolved at publication (Cymulate).

Fix. Create the folder as an administrator before deploying Cursor, remove write access for Users, and alert on changes to it.