What Cursor's 33 published security advisories teach about coding-agent safety

The short answer

Cursor lists 33 security advisories on its GitHub repository: 2 critical, 22 high, 7 medium and 2 low.¹ Grouped by what they’re about, the largest groups are sandbox escapes (7), MCP configuration and install flows (6), protected-file bypasses (5) and information leaks (5), with 3 command-allowlist bypasses and 3 cases where prompt injection reached code execution through special or workspace files.¹

Two lessons generalise to every coding agent. Files that configure the agent (MCP server lists, settings, hooks) are code, and an agent that can write them can run anything. And controls that read command text, such as allowlists, lose to shell syntax; controls the operating system enforces, such as sandboxes, are stronger but still have edges.

We credit Cursor for publishing these in detail. Few agent vendors do.

How we counted

We pulled every advisory from the GitHub API for cursor/cursor on 26 October 2026 and sorted each by its title into one group (first match wins). Dates are publication dates. Titles are Cursor’s. The grouping is ours; another reader might split them differently.

The six patterns

Counts from the advisory list.¹ The dates tell a story: as allowlists and file protections were hardened in 2025, the 2026 advisories moved to the sandbox, the newer and stronger control.

Pattern 1: agent config files are code

Two advisories from August 2025 show it most clearly.

Creating a config file needed no approval. CVE-2025-54135: Cursor let the agent write files in the workspace without approval; editing an existing dotfile required approval, but creating a new one didn’t. So if .cursor/mcp.json didn’t exist yet, an indirect prompt injection could make the agent create it, adding an MCP server whose command runs code. The fix blocked the agent from writing MCP-sensitive files without approval. Affected up to 1.2.1, fixed in 1.3.9.²

Changing an approved server needed no re-approval. CVE-2025-54136: once a user approved a harmless MCP server in a shared repository, someone with write access could swap its command for a malicious one with no new prompt. Cursor now asks every time an MCP server entry is modified, not just when one is added.³

The general rule for any agent: the files that tell an agent what to run (.cursor/mcp.json, .mcp.json, .claude/settings.json, .gemini/settings.json, .github/hooks/) deserve the same review as CI configuration, and an agent should never write them without a person. Gemini CLI’s trusted folders feature applies the same idea from the other side.

Pattern 2: allowlists read text

CVE-2025-54131: in auto-run mode with an allowlist (not the default, which asks for every terminal call), a command could run outside the allowlist using a backtick or $(cmd). The fix moved the allowlist to a more robust parser.⁴ Later advisories found more ways round allowlists, including one using environment variables (CVE-2026-22708).¹

That’s the same lesson VS Code states in its own docs: terminal auto-approval is a convenience, not a boundary. Our VS Code auto-approve post shows why with worked examples. If an allowlist is your only control, assume a determined prompt injection gets past it.

Pattern 3: sandboxes have edges

Seven of the advisories are sandbox escapes, two of them critical. One shows how subtle the edges are. CVE-2026-50548: Cursor’s sandbox grants write access to a command’s working directory, and the agent could set that working directory itself, so the sandbox could include writable paths outside the workspace. That allowed overwriting the sandbox helper so later commands ran unsandboxed. Fixed in 3.0, which no longer grants write access based on an agent-controlled working directory.⁵

Other escapes in the list ran through git hooks, Python virtual environments, privileged containers and another agent’s hook configuration.¹ The pattern: anything that runs later, outside the sandbox, and reads files the sandboxed command could write, is a way out. Sandboxes are still the strongest control a coding agent has; our Claude Code sandbox post lists the equivalent gaps that Claude Code documents.

Pattern 4: protected-file lists meet path quirks

Five advisories bypassed protections on sensitive files, including backslash paths and NTFS quirks on Windows, and writing a new .cursorignore.¹ Lists of protected paths are only as good as path normalisation, which differs by operating system. The safer design is the one the sandbox advisories were moving towards: decide by where a resolved path really is, after links and quirks, not by how it was spelled.

What to do with this

• Keep coding agents updated. Most of these were fixed in a release; the risk is running last quarter’s version.
• Treat agent config files as code. Review changes to MCP and settings files in pull requests; never let an agent write them unattended.
• Don’t rely on allowlists alone. Use the sandbox, and keep auto-run off for anything that touches credentials or production.
• Keep secrets off the machine where possible. Escapes matter less when there’s nothing valuable to reach.
• Watch vendor advisory pages. Cursor, Anthropic, Google and others publish on GitHub; subscribing costs nothing.
• Read the advisories for your own tools the way we read these. Group them by pattern, not by date. A cluster of fixes in one area tells you where the vendor is still learning, and where your own extra controls matter most right now.

The mcp-remote advisory is a related case outside Cursor. To check what the MCP servers in a repository’s config could do before you trust it, paste the config into the check page, run npx deedglass scan (how the grade works), or add the scan Action to pull requests; to try tool-call rules in your browser, open the playground.

Written with AI assistance and checked against our claims register.