Cursor AI IDE Sandbox Bypasses Enable OS RCE via Working Directory and Symlink Manipulation

Cato Networks disclosed two independent flaws reported in February and patched in Cursor 3.0 on April 2. The first abuses non-default working_directory parameters to expand the allow list, letting an MCP-sourced prompt direct the agent to replace the sandbox binary. The second exploits symlink resolution fallbacks where the agent checks the original path instead of the target, enabling write-only links to the same binary. Both chains require only ingestion of attacker-controlled context.

The defects expose a recurring pattern across AI coding agents: automatic terminal execution without user approval combined with weak path isolation. Similar symlink and environment variable tricks have appeared in prior supply-chain analyses of tools like Continue.dev and Aider. Cursor's design assumption that LLM-generated commands stay within project bounds collapses once the sandbox executable itself is reachable.

Official CVEs were assigned in June with no independent technical attribution published beyond Cato's report. This leaves open whether the same primitives affect other Electron-based IDEs sharing the MCP server model. Operational impact is immediate for teams using Cursor on developer workstations with access to production credentials.

Next steps include mandatory sandbox re-verification on every command and deprecation of implicit path expansion. Procurement records show rising adoption of AI IDEs in defense-adjacent firms, increasing the blast radius of any unpatched instance.