Summary
Security researchers publicly disclosed a critical zero-day vulnerability in the Cursor AI code editor this week, dubbed DuneSlide, that enables zero-click prompt injection leading to full OS-level remote code execution. The vulnerability allows an attacker to craft a malicious code repository — poisoned documentation, README files, or comments — that silently triggers Cursor’s AI agent to execute attacker-controlled commands without any user interaction beyond opening the project.
According to the disclosure from Mindgard AI, the vulnerability was reported to Cursor’s security team over six months ago but remained unpatched, prompting a full public disclosure under the principle that “full disclosure becomes the only protection left.” The attack chain works by exploiting the trust relationship between Cursor’s AI agent and its codebase context window: specially crafted text in repository files gets interpreted as agent instructions, enabling arbitrary shell command execution in the developer’s environment.
Cursor is widely used among professional developers and security engineers, making this a high-value supply-chain attack vector. There is currently no patch available. The recommended mitigations are to disable Cursor’s agentic features when opening untrusted repositories and to review any projects opened recently for unexpected file modifications or outbound network connections.
Sources
- Mindgard AI — Cursor 0-Day: When Full Disclosure Becomes the Only Protection Left
- Dark Reading — Cursor IDE: Malicious Code from Poisoned Repos
Commentary
This is a textbook example of why AI coding assistants represent a fundamentally new attack surface that hasn’t been adequately threat-modeled. The entire value proposition of an AI code agent is that it reads your codebase and acts on it — but that same capability becomes a privilege escalation primitive if the agent can’t distinguish repository content from trusted instructions. Any developer who clones a malicious repo and opens it in Cursor is potentially compromised with zero clicks.
Six months without a patch is also a damning indictment. For an AI-native development tool used by security professionals, sitting on an unauthenticated RCE for half a year is inexcusable. Red teams should absolutely be incorporating poisoned repository attacks into their initial-access playbooks — if this works on developers’ machines, it works on build servers too.