Full disclosure: Arbitrary code execution in Cursor

16 points by owent

czarkoff

I was expecting a joke about the AI agents executing whatever occurs to them amounting to arbitrary code execution. But as alway AI tools surpass expectations...

einacio

Yeah, me too. ACE is a default-enabled feature of Cursor. You also have to disable to the one to download prompt injections from the internet

hoistbypetard

I don't think it's hyperbolic to suggest that their response to the report here opens the question of whether this might be a backdoor as opposed to a bug.

I guess my opinion is irrelevant here, because I wasn't going to ever use it anyway. But if I were responsible for endpoint security in a place, I'd be banning cursor rather than trying to mitigate this the way the disclosure post suggests.

mdaniel

a tale as old as time: don't put . in your $PATH/%PATH%

Halkcyon

Doesn't cmd.exe do this automatically?
hoistbypetard

This feels like, along with the dangers of in-band command channels, one of many lessons being re-learned by LLM enjoyers.

Gaelan

Several people on HN note that Cursor ships with VS Code's workspace trust disabled by default. So in Cursor's default configuration, the trust model doesn't allow for opening untrusted codebases anyway.

However:

That's a terrifying default.
If Cursor are going to allow users to enable workspace trust, they'd better made it work as described, i.e. not execute arbitrary code in restricted workspaces.