Cursor AI Hack Lets Shady Web Pages Execute Code on Your PC

Security researchers at Cato Networks discovered that the Cursor AI-powered development environment could be tricked into running malicious commands directly on a programmer's computer. The vulnerability allowed attackers to bypass the editor's built-in sandbox, which was supposed to keep the artificial intelligence in a safe digital playpen.

The magic trick happens through a classic prompt injection, but with a nasty physical twist. Instead of just making the AI say something silly, an attacker can feed malicious instructions through external data sources, like a rigged Google search result or a sketchy server response. Once the AI processes this poisoned input, it gets confused and happily overwrites critical system files outside its sandbox, such as the user's terminal configuration.

One of the bugs, registered as CVE-2026-50548, exploited how the AI handled directory paths, letting the model save files wherever the attacker wanted. The second flaw, CVE-2026-50549, took advantage of symbolic links, failing to double-check where the links actually pointed. Combined, they allowed external hackers to quietly execute arbitrary code with the developer's own privileges, earning both vulnerabilities a near-maximum severity score of 9.8 out of 10.

Users running version 3.0 or later are safe, as the developers have already patched both loopholes.

Giving AI agents direct access to terminals and operating systems was always a recipe for disaster, yet the entire tech industry rushed into it like a gold rush. It turns out that building a fortress around an LLM is pointless when the model itself can be easily sweet-talked into dismantling the walls from the inside. The real comedy will begin when these agents start ordering actual physical items using corporate credit cards.

Source: Cato Networks