Cursor cursor.com ↗

AI-first IDE forked from VS Code. CVE-2025-54135 (CurXecute, MCP RCE), CVE-2025-54136 (MCPoison), CVE-2025-59944 (case-insensitive bypass). Workspace Trust ships disabled by default.

Enforce Privacy Mode and Zero Data Retention

Cursor uploads code chunks for embeddings, completions, and chat. Privacy Mode triggers Zero Data Retention (ZDR) contracts with model providers so no code is stored or used for training. On by default for team members; verify per-user.

Path: Cursor Settings → General → Privacy Mode.

Tip: for Teams/Enterprise, enforce Privacy Mode org-wide via the admin dashboard so it cannot be toggled off locally; pair with telemetry.telemetryLevel: "off".

Disable Auto-Run / YOLO Mode

Auto-Run lets the agent execute terminal commands without approval. Backslash Security demonstrated 4+ ways to bypass the denylist (base64, obfuscation, shell builtins) and Cursor deprecated the denylist in v1.3.

Path: Cursor Settings → Chat → Enable auto-run mode (toggle OFF). If required, configure Allowlist with a minimal set; never include rm, curl, wget, find, bash, sh, python, node, pip, npm.

Tip: treat the allowlist as defense-in-depth, not a boundary. Always review commands before approval.

Enable Workspace Trust Before Opening Unknown Repos

Cursor inherits VS Code's Workspace Trust but ships it disabled. A repo with .vscode/tasks.json runOptions.runOn: folderOpen runs on clone (Oasis Security "Open-Folder Autorun").

"security.workspace.trust.enabled": true,
"security.workspace.trust.startupPrompt": "always",
"security.workspace.trust.untrustedFiles": "prompt",
"task.allowAutomaticTasks": "off"

Tip: open unknown repos in a disposable VM or container; never as a trusted workspace.

Lock Down MCP Server Configuration

Both CurXecute and MCPoison abused ~/.cursor/mcp.json and <project>/.cursor/mcp.json. CurXecute is fixed in v1.3, case-sensitivity bypass in v1.7. Run a current version.

Real incident CurXecute (CVE-2025-54135): a single prompt-injected Jira/Slack/GitHub MCP response could rewrite ~/.cursor/mcp.json with a new server pointing at attacker-controlled commands — executed on next Cursor restart with the developer's shell privileges. MCPoison (CVE-2025-54136) bypassed the trust-binding by reusing approved MCP key names with swapped commands. Aim Security (CurXecute) · Check Point (MCPoison)

Paths to audit: ~/.cursor/mcp.json, <repo>/.cursor/mcp.json — chmod 600 on macOS/Linux; track in Git with mandatory PR review (add to CODEOWNERS).

Tip: use OAuth with minimum scopes; reference secrets via ${env:VAR_NAME} in mcp.json. Enterprise admins should publish a centralized MCP allowlist.

Harden Rules Files Against Hidden-Unicode Injection

Rules files (.cursorrules, .cursor/rules/*.mdc) apply to every AI interaction in the workspace, making them a supply-chain attack vector. Researchers demonstrated zero-width joiners and bidirectional control characters that silently instructed the model to insert backdoors.

Check: pre-commit hook that rejects rules files containing Unicode categories Cf (format) or characters in U+200B-U+200F, U+202A-U+202E, U+2066-U+2069.

Tip: add .cursorrules and .cursor/rules/ to CODEOWNERS, require human review on every change, render with a hex viewer when in doubt.

Exclude Secrets via `.cursorignore` (with Caveats)

.cursorignore blocks Tab, semantic search, inline edit, and @mention access. Critically, Cursor docs state: "terminal and MCP server tools used by Agent cannot block access to code governed by .cursorignore" — the agent can still cat ignored files.

.env*
**/*.pem
**/*.key
**/id_rsa*
.aws/
.kube/
.ssh/
terraform.tfstate*
secrets/

Tip: defense-in-depth only. Combine with OS-level secret stores (Keychain, Vault, AWS Secrets Manager) and pre-commit secret scanning (gitleaks, trufflehog).

Restrict Indexing Scope

Indexing uploads chunks to compute embeddings. Reducing index surface limits blast radius if a workspace contains secrets or proprietary IP.

Path: Cursor Settings → Features → Codebase Indexing — disable on sensitive repos, or use .cursorindexingignore for node_modules, dist, vendor, build artifacts. Consider disabling Shadow Workspace if not required.

Tip: for highly sensitive monorepos, turn indexing off entirely and rely on explicit @file/@folder references.

Run the Agent in a Sandbox / Isolated User Account

Even with auto-run off, accidental approvals or rule injection can yield code execution at developer privileges. Cursor 2.5+ supports Sandbox Mode with network restrictions; combine with OS-level isolation.

Implementation: dedicated macOS user account or Linux container (Docker/Podman, non-root, no host SSH keys mounted); on macOS use App Sandbox / TCC restrictions to deny access to ~/.ssh, ~/.aws, ~/Library/Keychains. On Linux, AppArmor / bubblewrap profiles.

Tip: never run agent mode as root or with cloud admin credentials in the environment.

Manage Extensions and Treat Untrusted Inputs as Hostile

Cursor uses Open VSX. A June 2025 malicious extension on Open VSX was linked to a $500K crypto theft. Every MCP tool that returns external content (Jira/GitHub issues, Slack, web search, email) is an injection vector — the CurXecute attack class.

Action: audit installed extensions; remove any with <10k installs, unverified publishers, or no updates in >12 months. Enterprise admins should publish an extension allowlist via MDM.

Real incident May 2025 — Socket caught three malicious npm packages (sw-cur, sw-cur1, aiide-cur) marketed as "cheapest Cursor API" that overwrote Cursor's main.js with a credential-stealing backdoor and disabled auto-update. 3,200+ developers installed them before takedown. The Hacker News

Mitigation: disable MCP servers whose tool output you cannot trust. For browser/web MCPs, never enable auto-run. Review every diff and command the agent proposes — especially writes to .cursor/, .vscode/, ~/.cursor/, ~/.ssh/, CI config, and package.json scripts.

Enterprise Governance: SSO, SCIM, Audit Logs, Model Blocklist

For team deployments, push enforcement off the endpoint and onto identity/policy.

Path: Cursor Admin Dashboard → Identity & Access for SAML 2.0 SSO (Okta, Entra, Google Workspace), SCIM 2.0 provisioning, RBAC; → Compliance for audit log export (SIEM streaming on Enterprise); → Model Controls to enforce a model blocklist and CMEK on Enterprise.

Tip: enforce SSO + disable local login, automate offboarding via SCIM, stream audit logs to a SIEM, block models that lack ZDR contracts, and apply MDM policies for non-bypassable Privacy Mode and Workspace Trust.

References & further reading