# Cursor AI Code Editor Autorun Flaw Enables Silent Code Execution via Malicious Repositories

> Cursor, the AI-powered Visual Studio Code fork, ships with Workspace Trust disabled by default, allowing a malicious repository containing a crafted .vscode/tasks.json file (runOptions.runOn: 'folderOpen') to auto-execute attacker-controlled commands the instant a developer opens the folder — with no prompt and no consent.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1307
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-cursor-open-folder-autorun-flaw-tl-2026-1307.webp?v=da2484f1 (Threadlinqs threat intel: Cursor Autorun Flaw in Malicious Repos: Detection & IOCs (TL-2026-1307) — High severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-1307
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19

## Description

Oasis Security researcher Erez Schwartz disclosed a design-level 'open-folder autorun' flaw in Cursor, the AI-powered fork of Visual Studio Code. VS Code introduced Workspace Trust as a security boundary specifically to prevent untrusted folders from silently running tasks, extensions, or debug configurations; Cursor ships with Workspace Trust disabled out of the box because, per Cursor's own statement, 'Workspace Trust disables AI and other features our users want to use within the product.'

The practical consequence is that any public or shared repository can carry a `.vscode/tasks.json` file whose `runOptions.runOn` property is set to `folderOpen`. When a developer opens that folder in Cursor — even just to browse the code — the task's configured command executes immediately in the user's own OS security context, with no trust prompt, no warning banner, and no interaction required. This converts a routine, low-trust action ('I'll just take a quick look at this repo') into full silent code execution, functionally analogous to legacy Windows `autorun.inf` attacks on removable media.

Because the payload runs as the logged-in developer, an attacker can harvest readable environment variables and locally stored secrets (API tokens, cloud credentials, SSH keys, `.env` files, CI/CD tokens), spawn a reverse shell or beacon to attacker infrastructure for C2, tamper with source files or build scripts to seed a downstream supply-chain compromise, or pivot further into the developer's organization — an 'organization-wide blast radius' per Oasis Security's advisory language. The attack requires no privilege escalation and no exploitation of a memory-safety bug; it abuses an intentional VS Code-compatible task-automation feature that Cursor left unguarded.

Oasis Security reported the issue to Cursor on September 10, 2025. Cursor's engineering team responded that it intends to keep the autorun behavior enabled by default, reiterating that disabling Workspace Trust is required for several AI-assistant features to function, and pointed users toward manually enabling Workspace Trust and forthcoming updated security guidance. As of publication, no CVE identifier has been assigned to this specific autorun/Workspace Trust design issue and no confirmed in-the-wild exploitation has been reported, though the attack path is trivial to replicate and the flaw class (auto-executing tasks from untrusted folders) is a known and previously-patched VS Code security concern.

This disclosure sits alongside a broader pattern of 2025 Cursor security issues stemming from the editor's AI/MCP feature surface: CVE-2025-54135 ('CurXecute', CVSS 8.6, AIM Security) allowed prompt-injection via a connected MCP server (e.g., Slack) to silently rewrite `~/.cursor/mcp.json` and achieve RCE before a user could reject the AI's suggested edit; CVE-2025-54136 ('MCPoison', CVSS 7.2, Check Point Research) allowed an attacker to modify an already-trusted project-level `mcp.json` after approval — since trust was bound to the MCP server's name rather than its content — to silently swap in malicious commands without re-approval. Both were patched by Cursor (fix shipped in version 1.3 for CurXecute); the Workspace Trust/tasks.json autorun issue covered here remains an accepted design tradeoff as of disclosure. Collectively these findings establish a recurring theme: Cursor repeatedly trades default-secure behavior for AI/MCP feature convenience, and each surface (task automation, MCP config trust, MCP auto-start) has independently proven exploitable.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1059.001 PowerShell
- T1546 Event Triggered Execution
- T1547.009 Shortcut Modification
- T1525 Implant Internal Image
- T1127 Trusted Developer Utilities Proxy Execution
- T1036 Masquerading
- T1211 Exploitation for Stealth
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1602 Data from Configuration Repository
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation
- T1587.001 Malware
- T1585.001 Social Media Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Cursor IDE Spawns Shell Immediately After Folder Open — Autorun Exploitation** (`TL-2026-1307-SPL-001`)

Detects the Cursor.exe (Windows) / Cursor (macOS/Linux binary) process spawning cmd.exe, powershell.exe, pwsh.exe, bash, or sh within seconds of a new folder/workspace being opened, with no preceding Workspace Trust prompt — the observable footprint of a .vscode/tasks.json runOptions.runOn:'folderOpen' autorun payload firing.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1189, T1204.002, T1059, T1059.001
- **Data sources:** sysmon, windows_security, microsoft_defender_deviceprocessevents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImage=lower(ParentImage), Image=lower(Image)
| where like(ParentImage, "%\\cursor.exe") AND (like(Image, "%\\cmd.exe") OR like(Image, "%\\powershell.exe") OR like(Image, "%\\pwsh.exe"))
| eval time_since_parent_start=strptime(_time,"%Y-%m-%dT%H:%M:%S")-strptime(ParentProcessId,"%Y-%m-%dT%H:%M:%S")
| table _time, ComputerName, User, ParentImage, ParentProcessId, Image, ProcessId, CommandLine
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("Cursor.exe", "Cursor")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessId, FileName, ProcessId, ProcessCommandLine, FolderPath
```

### Sigma

```yaml
title: Cursor IDE Spawning Shell Process Immediately After Folder Open
id: 8f1a2b3c-0001-4a00-9c00-cursor01folder
status: experimental
description: Detects Cursor (Windows/macOS/Linux) spawning a shell interpreter within seconds of a folder-open event, consistent with .vscode/tasks.json runOptions.runOn:folderOpen autorun exploitation.
references:
    - https://www.oasis.security/blog/cursor-security-flaw
    - https://thehackernews.com/2025/09/cursor-ai-code-editor-flaw-enables.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-14
tags:
    - attack.initial_access
    - attack.t1189
    - attack.execution
    - attack.t1204.002
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Cursor.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Developer manually opens an integrated terminal in Cursor shortly after opening a folder
    - Legitimate build/task automation explicitly approved by the developer after a Workspace Trust prompt
level: high
```

**Known false positives:**

- Developer manually opens an integrated terminal in Cursor shortly after opening a folder
- Legitimate build/task automation the developer explicitly approved after a Workspace Trust prompt

**Tuning notes:** Tune the time window between folder-open telemetry (if available from IDE/EDR) and child-process spawn to a few seconds; whitelist known internal build tasks by CommandLine hash; correlate with absence of a Workspace Trust prompt dialog event if the EDR captures UI events.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Repository Delivers Weaponized [indicator] With runOn:folderOpen (locked: unlock with TL Creds)
- Cursor Endpoint Configured With Workspace Trust Disabled and Automatic Tasks Allowed (locked: unlock with TL Creds)
- MCP Config File ([indicator]) Silently Modified by Non-User Process (locked: unlock with TL Creds)
- Repeated Rapid Folder-Open Autorun Pattern Across Many Cursor Windows (locked: unlock with TL Creds)
- System/Environment Discovery Commands Executed by Cursor-Spawned Shell (locked: unlock with TL Creds)
- Cursor-Initiated Ingress Tool Transfer / Download Immediately After Folder Open (locked: unlock with TL Creds)
- Cursor-Spawned Process Reading AWS/SSH/[indicator] Credential Files — Post-Autorun Harvesting (locked: unlock with TL Creds)
- Outbound C2 Beacon From Cursor-Spawned Process After Folder Open (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Cursor AI Code Editor Flaw Enables Silent Code Execution via Malicious Repositories](https://thehackernews.com/2025/09/cursor-ai-code-editor-flaw-enables.html)
- [Cursor "Open-Folder" Autorun Vulnerability Exposes Developers to Silent Code Execution](https://www.oasis.security/blog/cursor-security-flaw)
- [Cursor Workspace Trust Vulnerability: Protect Your Data & AI](https://www.oasis.security/resources/reports/cursor-workspace-trust-vulnerability)
- [Cursor AI editor lets repos "autorun" malicious code on devices](https://www.bleepingcomputer.com/news/security/cursor-ai-editor-lets-repos-autorun-malicious-code-on-devices/)
- [Cursor's autorun lets hackers execute arbitrary code](https://www.csoonline.com/article/4054796/cursors-autorun-lets-hackers-execute-arbitrary-code.html)
- [Cursor AI Code Editor RCE Vulnerability Enables "autorun" of Malicious on your Machine](https://cybersecuritynews.com/cursor-ai-code-editor-rce-vulnerability/)
- [Oasis Security Identifies Security Weakness in Cursor AI Coding Tool](https://devops.com/oasis-security-identifies-security-weakness-in-cursor-ai-coding-tool/)
- [New Vulnerability Exposes Developers to Silent Code Execution](https://securitybuzz.com/cybersecurity-news/new-vulnerability-exposes-developers-to-silent-code-execution/)
- [Cursor AI Code Editor vulnerabilities CurXecute and MCPoison (CVE-2025-54135, CVE-2025-54136)](https://www.tenable.com/blog/faq-cve-2025-54135-cve-2025-54136-vulnerabilities-in-cursor-curxecute-mcpoison)
- [When Public Prompts Turn Into Local Shells: 'CurXecute' – RCE in Cursor via MCP Auto-Start](https://www.aim.security/post/when-public-prompts-turn-into-local-shells-rce-in-cursor-via-mcp-auto-start)
- [Cursor IDE's MCP Vulnerability (MCPoison)](https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/)
- [Cursor AI Code Editor Vulnerability Enables RCE via Malicious MCP File Swaps Post Approval](https://thehackernews.com/2025/08/cursor-ai-code-editor-vulnerability.html)
- [VS Code Workspace Trust documentation](https://code.visualstudio.com/docs/editor/workspace-trust)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1307