Cursor AI Code Editor Autorun Flaw Enables Silent Code Execution via Malicious Repositories

Cursor AI Code Editor Autorun Flaw Enables Silent Code (TL-2026-1307), also tracked as Cursor Open-Folder Autorun Vulnerability, is a high-severity software vulnerability, first published 2026-07-14. It has no confirmed attribution, affects Cursor (Anysphere) Cursor AI Code Editor, maps to 24 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-1307

Threat ID
TL-2026-1307
Also known as
Cursor Open-Folder Autorun Vulnerability, Cursor Workspace Trust Bypass
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-07-14
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, software-development, all-sectors-using-cursor
Target regions
Global
Detection rules
9
Indicators of compromise
19

Cursor, the AI-powered Visual Studio Code fork, ships with Workspace Trust disabled by default, allowing a malicious repository containing a crafted .vscode/tasks.json file (runOptions.runOn: 'folderOpen') to auto-execute attacker-controlled commands the instant a developer opens the folder — with no prompt and no consent.

How Cursor AI Code Editor Autorun Flaw Enables Silent Code works

Oasis Security researcher Erez Schwartz disclosed a design-level 'open-folder autorun' flaw in Cursor, the AI-powered fork of Visual Studio Code. VS Code introduced Workspace Trust as a security boundary specifically to prevent untrusted folders from silently running tasks, extensions, or debug configurations; Cursor ships with Workspace Trust disabled out of the box because, per Cursor's own statement, 'Workspace Trust disables AI and other features our users want to use within the product.'

The practical consequence is that any public or shared repository can carry a `.vscode/tasks.json` file whose `runOptions.runOn` property is set to `folderOpen`. When a developer opens that folder in Cursor — even just to browse the code — the task's configured command executes immediately in the user's own OS security context, with no trust prompt, no warning banner, and no interaction required. This converts a routine, low-trust action ('I'll just take a quick look at this repo') into full silent code execution, functionally analogous to legacy Windows `autorun.inf` attacks on removable media.

Because the payload runs as the logged-in developer, an attacker can harvest readable environment variables and locally stored secrets (API tokens, cloud credentials, SSH keys, `.env` files, CI/CD tokens), spawn a reverse shell or beacon to attacker infrastructure for C2, tamper with source files or build scripts to seed a downstream supply-chain compromise, or pivot further into the developer's organization — an 'organization-wide blast radius' per Oasis Security's advisory language. The attack requires no privilege escalation and no exploitation of a memory-safety bug; it abuses an intentional VS Code-compatible task-automation feature that Cursor left unguarded.

Oasis Security reported the issue to Cursor on September 10, 2025. Cursor's engineering team responded that it intends to keep the autorun behavior enabled by default, reiterating that disabling Workspace Trust is required for several AI-assistant features to function, and pointed users toward manually enabling Workspace Trust and forthcoming updated security guidance. As of publication, no CVE identifier has been assigned to this specific autorun/Workspace Trust design issue and no confirmed in-the-wild exploitation has been reported, though the attack path is trivial to replicate and the flaw class (auto-executing tasks from untrusted folders) is a known and previously-patched VS Code security concern.

This disclosure sits alongside a broader pattern of 2025 Cursor security issues stemming from the editor's AI/MCP feature surface: CVE-2025-54135 ('CurXecute', CVSS 8.6, AIM Security) allowed prompt-injection via a connected MCP server (e.g., Slack) to silently rewrite `~/.cursor/mcp.json` and achieve RCE before a user could reject the AI's suggested edit; CVE-2025-54136 ('MCPoison', CVSS 7.2, Check Point Research) allowed an attacker to modify an already-trusted project-level `mcp.json` after approval — since trust was bound to the MCP server's name rather than its content — to silently swap in malicious commands without re-approval. Both were patched by Cursor (fix shipped in version 1.3 for CurXecute); the Workspace Trust/tasks.json autorun issue covered here remains an accepted design tradeoff as of disclosure. Collectively these findings establish a recurring theme: Cursor repeatedly trades default-secure behavior for AI/MCP feature convenience, and each surface (task automation, MCP config trust, MCP auto-start) has independently proven exploitable.

MITRE ATT&CK techniques used in TL-2026-1307

Collection

T1005 Data from Local System; T1602 Data from Configuration Repository

Defense Evasion

T1036 Masquerading; T1127 Trusted Developer Utilities Proxy Execution; T1211 Exploitation for Stealth

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.004 Unix Shell; T1204.002 Malicious File

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1189 Drive-by Compromise; T1195.002 Compromise Software Supply Chain

Persistence

T1525 Implant Internal Image; T1546 Event Triggered Execution; T1547.009 Shortcut Modification

Credential Access

T1552.001 Credentials In Files; T1552.004 Private Keys

Impact

T1565 Data Manipulation

Resource Development

T1585.001 Social Media Accounts; T1587.001 Malware

Affected products and versions in Cursor AI Code Editor Autorun Flaw Enables Silent Code

  • Cursor (Anysphere) — Cursor AI Code Editor
    Vulnerable versions: all versions with default configuration (Workspace Trust disabled by default)
    Fixed in: none — vendor has not patched; mitigated only via manual Workspace Trust configuration

Remediation for Cursor AI Code Editor Autorun Flaw Enables Silent Code

Patches

  • No patch exists for this specific Workspace Trust/tasks.json autorun design issue; Cursor has stated it intends to retain default autorun behavior and recommends manual mitigation
  • Cursor version 1.3 patches the related CVE-2025-54135 (CurXecute) MCP auto-start RCE issue

Immediate actions

  • Enable Workspace Trust in Cursor (Settings > Security > Workspace Trust) and require the startup trust prompt
  • Set task.allowAutomaticTasks to 'off' in Cursor/VS Code settings to block auto-executing tasks regardless of trust state
  • Do not open unfamiliar or unaudited repositories directly in Cursor with default settings
  • Review any repository's .vscode/tasks.json for a runOptions.runOn value of 'folderOpen' before opening the folder
  • Rotate any credentials, API tokens, or SSH keys that were present in environment variables or config files on a workstation where an untrusted repo was opened

Workarounds

  • Manually enable Workspace Trust and set task.allowAutomaticTasks: 'off' via Cursor's settings.json
  • Use Visual Studio Code (which enables Workspace Trust by default) instead of Cursor for reviewing untrusted or unfamiliar repositories

Longer-term hardening

  • Open unknown or third-party repositories only in an isolated, disposable environment (container, VM, or a viewer-only/read-only editor) rather than a full-privilege developer IDE
  • Deploy endpoint monitoring for unexpected IDE-spawned child processes and outbound network connections immediately following a folder-open event in Cursor
  • Enforce organization-wide Cursor configuration policy (MDM/EDR-pushed settings) that mandates Workspace Trust enabled and automatic tasks disabled across all developer endpoints
  • Minimize long-lived secrets in developer shell profiles and environment variables; prefer short-lived, scoped credentials and secret managers over static tokens on disk
  • Track and patch downstream Cursor AI/MCP vulnerabilities promptly (e.g., CVE-2025-54135, CVE-2025-54136) given the editor's recurring history of trust-boundary weaknesses in its AI/MCP feature surface

Weaknesses (CWE) in Cursor AI Code Editor Autorun Flaw Enables Silent Code

CWE-1188, CWE-276, CWE-494

Timeline of Cursor AI Code Editor Autorun Flaw Enables Silent Code

  • AIM Security discloses CurXecute (CVE-2025-54135, CVSS 8.6), a separate Cursor RCE vulnerability abusing prompt injection via connected MCP servers to silently rewrite ~/.cursor/mcp.json.
  • Check Point Research discloses MCPoison (CVE-2025-54136, CVSS 7.2), a Cursor vulnerability allowing silent post-approval tampering of trusted MCP server configurations.
  • BleepingComputer publishes coverage of the disclosure, confirming Visual Studio Code is not affected because it enables Workspace Trust by default.
  • Oasis Security publishes its technical blog post and report detailing the Cursor 'Open-Folder' Autorun Vulnerability.
  • Cursor responds that it intends to retain the default autorun behavior, stating Workspace Trust disables AI and other features users want, and points to manual mitigation and forthcoming updated security guidance.
  • Oasis Security researcher Erez Schwartz reports the Workspace Trust / .vscode/tasks.json autorun issue to the Cursor team via responsible disclosure.
  • CSO Online publishes expert commentary from CISOs on the systemic risk of AI-IDE vendors trading secure defaults for feature convenience.
  • The Hacker News publishes coverage of the disclosure, syndicated from the original DarkReading report, cementing broader security-press awareness.
  • Oasis Security's disclosure resource page is updated with additional guidance content.
  • Threat added to Threadlinqs Intelligence Platform backlog and researched for detection-engineering coverage; no CVE assigned and no confirmed in-the-wild exploitation as of this date.

Sources cited for Cursor AI Code Editor Autorun Flaw Enables Silent Code

Threats related to Cursor AI Code Editor Autorun Flaw Enables Silent Code

Detection coverage for TL-2026-1307

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1307 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats