Cursor AI Code Editor Autorun Flaw Enables Silent Code Execution via Malicious Repositories

Key facts for Cursor open-folder autorun flaw

Detection coverage for Cursor open-folder autorun flaw

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1307 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Cursor IDE Spawns Shell Immediately After Folder Open — Autorun Exploitation

Detects the Cursor.exe (Windows) / Cursor (macOS/Linux binary) process spawning cmd.exe, powershell.exe, pwsh.exe, bash, or sh within seconds of a new folder/workspace being opened, with no preceding Workspace Trust prompt — the observable footprint of a .vscode/tasks.json runOptions.runOn:'folderOpen' autorun payload firing.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1189, T1204.002, T1059, T1059.001
• Data sources: sysmon, windows_security, microsoft_defender_deviceprocessevents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImage=lower(ParentImage), Image=lower(Image)
| where like(ParentImage, "%\\cursor.exe") AND (like(Image, "%\\cmd.exe") OR like(Image, "%\\powershell.exe") OR like(Image, "%\\pwsh.exe"))
| eval time_since_parent_start=strptime(_time,"%Y-%m-%dT%H:%M:%S")-strptime(ParentProcessId,"%Y-%m-%dT%H:%M:%S")
| table _time, ComputerName, User, ParentImage, ParentProcessId, Image, ProcessId, CommandLine
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("Cursor.exe", "Cursor")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessId, FileName, ProcessId, ProcessCommandLine, FolderPath

Sigma

title: Cursor IDE Spawning Shell Process Immediately After Folder Open
id: 8f1a2b3c-0001-4a00-9c00-cursor01folder
status: experimental
description: Detects Cursor (Windows/macOS/Linux) spawning a shell interpreter within seconds of a folder-open event, consistent with .vscode/tasks.json runOptions.runOn:folderOpen autorun exploitation.
references:
    - https://www.oasis.security/blog/cursor-security-flaw
    - https://thehackernews.com/2025/09/cursor-ai-code-editor-flaw-enables.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-14
tags:
    - attack.initial_access
    - attack.t1189
    - attack.execution
    - attack.t1204.002
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Cursor.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Developer manually opens an integrated terminal in Cursor shortly after opening a folder
    - Legitimate build/task automation explicitly approved by the developer after a Workspace Trust prompt
level: high

Known false positives:

• Developer manually opens an integrated terminal in Cursor shortly after opening a folder
• Legitimate build/task automation the developer explicitly approved after a Workspace Trust prompt

Tuning notes: Tune the time window between folder-open telemetry (if available from IDE/EDR) and child-process spawn to a few seconds; whitelist known internal build tasks by CommandLine hash; correlate with absence of a Workspace Trust prompt dialog event if the EDR captures UI events.

• 🔒 Repository Delivers Weaponized [indicator] With runOn:folderOpen · unlock with TL Creds
• 🔒 Cursor Endpoint Configured With Workspace Trust Disabled and Automatic Tasks Allowed · unlock with TL Creds
• 🔒 MCP Config File ([indicator]) Silently Modified by Non-User Process · unlock with TL Creds
• 🔒 Repeated Rapid Folder-Open Autorun Pattern Across Many Cursor Windows · unlock with TL Creds
• 🔒 System/Environment Discovery Commands Executed by Cursor-Spawned Shell · unlock with TL Creds
• 🔒 Cursor-Initiated Ingress Tool Transfer / Download Immediately After Folder Open · unlock with TL Creds
• 🔒 Cursor-Spawned Process Reading AWS/SSH/[indicator] Credential Files — Post-Autorun Harvesting · unlock with TL Creds
• 🔒 Outbound C2 Beacon From Cursor-Spawned Process After Folder Open · unlock with TL Creds

Indicators of compromise for Cursor open-folder autorun flaw

As of 2026-07-14, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-1307.

How Cursor open-folder autorun flaw works

Oasis Security researcher Erez Schwartz disclosed a design-level 'open-folder autorun' flaw in Cursor, the AI-powered fork of Visual Studio Code. VS Code introduced Workspace Trust as a security boundary specifically to prevent untrusted folders from silently running tasks, extensions, or debug configurations; Cursor ships with Workspace Trust disabled out of the box because, per Cursor's own statement, 'Workspace Trust disables AI and other features our users want to use within the product.'

The practical consequence is that any public or shared repository can carry a `.vscode/tasks.json` file whose `runOptions.runOn` property is set to `folderOpen`. When a developer opens that folder in Cursor — even just to browse the code — the task's configured command executes immediately in the user's own OS security context, with no trust prompt, no warning banner, and no interaction required. This converts a routine, low-trust action ('I'll just take a quick look at this repo') into full silent code execution, functionally analogous to legacy Windows `autorun.inf` attacks on removable media.

Because the payload runs as the logged-in developer, an attacker can harvest readable environment variables and locally stored secrets (API tokens, cloud credentials, SSH keys, `.env` files, CI/CD tokens), spawn a reverse shell or beacon to attacker infrastructure for C2, tamper with source files or build scripts to seed a downstream supply-chain compromise, or pivot further into the developer's organization — an 'organization-wide blast radius' per Oasis Security's advisory language. The attack requires no privilege escalation and no exploitation of a memory-safety bug; it abuses an intentional VS Code-compatible task-automation feature that Cursor left unguarded.

Oasis Security reported the issue to Cursor on September 10, 2025. Cursor's engineering team responded that it intends to keep the autorun behavior enabled by default, reiterating that disabling Workspace Trust is required for several AI-assistant features to function, and pointed users toward manually enabling Workspace Trust and forthcoming updated security guidance. As of publication, no CVE identifier has been assigned to this specific autorun/Workspace Trust design issue and no confirmed in-the-wild exploitation has been reported, though the attack path is trivial to replicate and the flaw class (auto-executing tasks from untrusted folders) is a known and previously-patched VS Code security concern.

This disclosure sits alongside a broader pattern of 2025 Cursor security issues stemming from the editor's AI/MCP feature surface: CVE-2025-54135 ('CurXecute', CVSS 8.6, AIM Security) allowed prompt-injection via a connected MCP server (e.g., Slack) to silently rewrite `~/.cursor/mcp.json` and achieve RCE before a user could reject the AI's suggested edit; CVE-2025-54136 ('MCPoison', CVSS 7.2, Check Point Research) allowed an attacker to modify an already-trusted project-level `mcp.json` after approval — since trust was bound to the MCP server's name rather than its content — to silently swap in malicious commands without re-approval. Both were patched by Cursor (fix shipped in version 1.3 for CurXecute); the Workspace Trust/tasks.json autorun issue covered here remains an accepted design tradeoff as of disclosure. Collectively these findings establish a recurring theme: Cursor repeatedly trades default-secure behavior for AI/MCP feature convenience, and each surface (task automation, MCP config trust, MCP auto-start) has independently proven exploitable.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1602 Data from Configuration Repository

Defense Evasion

T1036 Masquerading; T1127 Trusted Developer Utilities Proxy Execution; T1211 Exploitation for Stealth

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.004 Unix Shell; T1204.002 Malicious File

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1189 Drive-by Compromise; T1195.002 Compromise Software Supply Chain

Persistence

T1525 Implant Internal Image; T1546 Event Triggered Execution; T1547.009 Shortcut Modification

Credential Access

T1552.001 Credentials In Files; T1552.004 Private Keys

Impact

T1565 Data Manipulation

Resource Development

T1585.001 Social Media Accounts; T1587.001 Malware

Remediation for Cursor open-folder autorun flaw

Patches

• No patch exists for this specific Workspace Trust/tasks.json autorun design issue; Cursor has stated it intends to retain default autorun behavior and recommends manual mitigation
• Cursor version 1.3 patches the related CVE-2025-54135 (CurXecute) MCP auto-start RCE issue

Immediate actions

• Enable Workspace Trust in Cursor (Settings > Security > Workspace Trust) and require the startup trust prompt
• Set task.allowAutomaticTasks to 'off' in Cursor/VS Code settings to block auto-executing tasks regardless of trust state
• Do not open unfamiliar or unaudited repositories directly in Cursor with default settings
• Review any repository's .vscode/tasks.json for a runOptions.runOn value of 'folderOpen' before opening the folder
• Rotate any credentials, API tokens, or SSH keys that were present in environment variables or config files on a workstation where an untrusted repo was opened

Workarounds

• Manually enable Workspace Trust and set task.allowAutomaticTasks: 'off' via Cursor's settings.json
• Use Visual Studio Code (which enables Workspace Trust by default) instead of Cursor for reviewing untrusted or unfamiliar repositories

Longer-term hardening

• Open unknown or third-party repositories only in an isolated, disposable environment (container, VM, or a viewer-only/read-only editor) rather than a full-privilege developer IDE
• Deploy endpoint monitoring for unexpected IDE-spawned child processes and outbound network connections immediately following a folder-open event in Cursor
• Enforce organization-wide Cursor configuration policy (MDM/EDR-pushed settings) that mandates Workspace Trust enabled and automatic tasks disabled across all developer endpoints
• Minimize long-lived secrets in developer shell profiles and environment variables; prefer short-lived, scoped credentials and secret managers over static tokens on disk
• Track and patch downstream Cursor AI/MCP vulnerabilities promptly (e.g., CVE-2025-54135, CVE-2025-54136) given the editor's recurring history of trust-boundary weaknesses in its AI/MCP feature surface

Affected and fixed versions

• Cursor (Anysphere) — Cursor AI Code Editor
  Vulnerable versions: all versions with default configuration (Workspace Trust disabled by default)
  Fixed in: none — vendor has not patched; mitigated only via manual Workspace Trust configuration

Timeline of Cursor open-folder autorun flaw

• 2025-08-01 AIM Security discloses CurXecute (CVE-2025-54135, CVSS 8.6), a separate Cursor RCE vulnerability abusing prompt injection via connected MCP servers to silently rewrite locked-ioc-11.
• 2025-08-05 Check Point Research discloses MCPoison (CVE-2025-54136, CVSS 7.2), a Cursor vulnerability allowing silent post-approval tampering of trusted MCP server configurations.
• 2025-09-10 BleepingComputer publishes coverage of the disclosure, confirming Visual Studio Code is not affected because it enables Workspace Trust by default.
• 2025-09-10 locked-ioc-12 publishes its technical blog post and report detailing the Cursor 'Open-Folder' Autorun Vulnerability.
• 2025-09-10 Cursor responds that it intends to retain the default autorun behavior, stating Workspace Trust disables AI and other features users want, and points to manual mitigation and forthcoming updated security guidance.
• 2025-09-10 locked-ioc-12 researcher locked-ioc-13 reports the Workspace Trust / locked-ioc-8 autorun issue to the Cursor team via responsible disclosure.
• 2025-09-11 CSO Online publishes expert commentary from CISOs on the systemic risk of AI-IDE vendors trading secure defaults for feature convenience.
• 2025-09-12 The Hacker News publishes coverage of the disclosure, syndicated from the original DarkReading report, cementing broader security-press awareness.
• 2026-05-01 locked-ioc-12's disclosure resource page is updated with additional guidance content.
• 2026-07-14 Threat added to Threadlinqs Intelligence Platform backlog and researched for detection-engineering coverage; no CVE assigned and no confirmed in-the-wild exploitation as of this date.

Sources cited for Cursor open-folder autorun flaw

• Cursor "Open-Folder" Autorun Vulnerability Exposes Developers to Silent Code Execution oasis.security · Vendor report · 2025-09-10
• Cursor Workspace Trust Vulnerability: Protect Your Data & AI oasis.security · Vendor report · 2025-09-10
• Cursor AI Code Editor vulnerabilities CurXecute and MCPoison (CVE-2025-54135, CVE-2025-54136) Tenable · Vendor report · 2025-08-05
• When Public Prompts Turn Into Local Shells: 'CurXecute' – RCE in Cursor via MCP Auto-Start aim.security · Research · 2025-08-01
• Cursor IDE's MCP Vulnerability (MCPoison) Check Point Research · Research · 2025-08-05
• VS Code Workspace Trust documentation code.visualstudio.com · Vendor report · 2025-09-10
• Cursor AI Code Editor Flaw Enables Silent Code Execution via Malicious Repositories The Hacker News · News · 2025-09-12
• Cursor AI editor lets repos "autorun" malicious code on devices BleepingComputer · News · 2025-09-10
• Cursor's autorun lets hackers execute arbitrary code csoonline.com · News · 2025-09-11
• Cursor AI Code Editor RCE Vulnerability Enables "autorun" of Malicious on your Machine cybersecuritynews.com · News · 2025-09-12
• Oasis Security Identifies Security Weakness in Cursor AI Coding Tool devops.com · News · 2025-09-11
• New Vulnerability Exposes Developers to Silent Code Execution securitybuzz.com · News · 2025-09-12
• Cursor AI Code Editor Vulnerability Enables RCE via Malicious MCP File Swaps Post Approval The Hacker News · News · 2025-08-05

Threats related to Cursor open-folder autorun flaw

• Claude Code Symlink Flaw in Startup Memory Loader Enables Silent File Exfiltration via CLAUDE.md Imports
• Prompt Injection in AWS Kiro Leads to Remote Code Execution via Unprotected MCP Config (mcp.json)
• Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp" Trick and Bun Runtime to Steal Developer Credentials Across npm, Go, and RubyGems

Previous and next in vulnerability

• ServiceNow AI Platform Sandbox Escape Enables Unauthenticated Remote Code Execution (CVE-2026-6875) Previous report