Cursor 'DuneSlide' — indirect prompt injection escapes the IDE sandbox to zero-click RCE (CVE-2026-50548 / CVE-2026-50549)
Disclosed vulnerability01 Jul 2026🗺️ Tool-Using AgentCato AI Labs disclosed two critical (CVSS 9.8) zero-click flaws in Cursor's coding agent where a single instruction hidden in content the agent reads — an MCP tool response or a web-search result — escapes the editor's terminal sandbox and runs OS-level commands with no click or approval.
Root cause — why it happened
Cursor is a coding assistant that can run commands on the developer's machine, but it runs them inside a locked 'sandbox' so a bad command can't touch the rest of the computer. The problem: the sandbox let the AI choose which folder a command could write to — and an attacker hid an instruction in content the AI read (a plug-in's reply, or a web page). Following that hidden instruction, the AI pointed a command at the very files that enforce the sandbox and overwrote them. With the lock broken, the next command ran with full access to the machine — no click, no approval.
Risks this case illustrates
Named in the standard (OWASP/ATLAS/NIST) lens. Click a highlighted component in the diagram below to see which risks attach where.
How it unfolded
A connected tool and an ordinary coding request
A developer is using Cursor with a plug-in connected (an MCP tool) and web search on, and asks it to do something completely normal — fix a bug, add a feature, look something up. The attacker has already planted a hidden instruction in content the agent will read; the developer never types anything malicious.
Controls & guardrails — what would have stopped it
The fix that actually closes this is making the sandbox unbreakable from the inside: the AI must not be allowed to point a command's folder at the sandbox's own files, and those enforcing files must be untouchable by anything the AI runs. Then, even a tricked agent that runs a command can't escape.
- Tool argument validation & sandboxingaddressesUnsafe Tool / Code Execution
Validates form, not intent — a well-formed call to a permitted tool can still be the wrong call. Sandboxing adds latency and isn't always feasible for tools that touch production.
- Least-privilege identity & scoped credentials
Doesn't prevent manipulation — only caps its reach. Hard to get right operationally; over-broad scopes are the common real-world failure.
- MCP/plugin pinning, manifest hashing & re-review
Review catches what reviewers understand; a subtle malicious directive can pass. Pinning helps only if you actually re-review on update rather than auto-accepting.
- Egress allowlisting & DLP on tool arguments
Allowlists fight an open-ended channel; legitimate-but-broad destinations (any URL fetch, any email) are hard to constrain without breaking usefulness. Encoding can evade naive DLP.
- Runtime monitoring & anomaly detection
Detects the anomalous, not the novel-but-subtle; high false-positive rates cause alert fatigue. Always a step behind a sufficiently quiet attacker.
- Full-trace audit logging
Logging is forensic, not preventive — it explains harm after the fact. Useless if no one reviews it or if the materialised context isn't captured.
- Governance: risk assessment, red-teaming & incident response
Process reduces likelihood and speeds recovery but executes no technical control itself; weak follow-through makes it theatre.
- Loop/cost circuit-breakers & consistency checks
Thresholds are blunt — too tight breaks legitimate long tasks, too loose lets damage accrue first. Catches runaway dynamics, not a single well-formed bad decision.
Lessons
- ▸ A sandbox is only a boundary if it protects its own integrity — an enforcer the sandboxed code can overwrite is not containment.
- ▸ Never derive a security-relevant parameter (like a writable-path allow-list) from an LLM-controlled argument; the model's output is attacker-influenceable.
- ▸ Path canonicalization must fail closed: reverting to a pre-resolution, in-workspace path on failure turns a symlink into an out-of-bounds write.
- ▸ Zero-click RCE follows whenever untrusted content the agent reads (MCP responses, web results) can steer a code-execution tool past its guardrail with no approval.
- ▸ Least-privilege OS execution shrinks the blast radius of any residual escape — treat the developer host and connected SaaS as the real crown jewels.
Proposals & gaps this case surfaced
Non-destructive suggestions for the library — proposed, not adopted.
A sandbox escape achieved not by a memory-safety exploit but by subverting the containment mechanism's own configuration or enforcing artefacts using the (attacker-influenced) code the sandbox is meant to contain. Arises when a security-relevant sandbox parameter — such as the writable-path allow-list — is derived from an LLM-controlled tool argument, when the enforcing binary is writable by sandboxed processes, or when path canonicalization fails open to a pre-resolution in-workspace path. A successful indirect prompt injection then escalates a sandboxed command into unsandboxed OS-level execution.
When an agent executes model-issued commands in a sandbox, harden the sandbox against subversion by the code it contains: (1) never derive a security-relevant parameter such as the writable-path allow-list from an LLM-controlled argument (e.g. a `working_directory`) — pin it to a fixed project subtree and reject system paths; (2) make the sandbox-enforcing binary/config immutable or attested so sandboxed processes cannot overwrite it; (3) canonicalize paths with a fail-closed policy so symlink-resolution failure denies the write rather than reverting to the original in-workspace path; and (4) run the sandbox under least-privilege OS context so any residual escape inherits minimal authority. Closes the DuneSlide vector where an indirect prompt injection rewrites the enforcer and escapes to OS-level RCE; complements injection filtering, MCP pinning, and egress control rather than relying on them.
This case shows a gap people miss: we say 'run risky commands in a sandbox' and treat the sandbox as safe — but here the sandbox itself was the target. If the AI can point a command at the files that enforce the sandbox, the lock can be broken from the inside. We should check that a sandbox can't be rewritten or reconfigured by the very code it is supposed to contain.
These surface as proposals across the Control Library and Risk Taxonomy; adopt them by hand when ready.
Sources
- DuneSlide: Two Critical RCE Vulnerabilities via Zero-Click Prompt Injection in Cursor IDE — Cato Networks (primary disclosure, 1 Jul 2026) ↗
- Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands — The Hacker News ↗
- Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution — SecurityWeek ↗
- Cato Networks — DuneSlide: Two Critical RCE Vulnerabilities via Zero-Click Prompt Injection in Cursor IDE (primary disclosure) ↗ — Original research; the working_directory allow-list + symlink-canonicalization sandbox-escape chain. CVSS 9.8 is Cato's rating.
- NVD — CVE-2026-50548 ↗ — Cursor sandbox escape via LLM-controlled working_directory added to the writable allow-list.
- NVD — CVE-2026-50549 ↗ — Cursor out-of-bounds write via fail-open path canonicalization of in-workspace symlinks.
- The Hacker News — Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands ↗ — Secondary reporting; zero-click framing and patch (Cursor 3.0).
Practise the risk class — related scenarios
A support email hides instructions — and the assistant obeys them
A text-to-SQL agent runs the model's output straight at the database
A poisoned issue makes the agent lie to the human who approves its actions
A fake Sentry error report hijacks a developer's coding agent into running a shell command
The forensic record is itself the attack surface — an agent's log is poisoned, then quietly rewritten
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A shopping page tells the agent to do something the user never asked for
An attacker plants prompt injection in the audit trail — so the LLM that hunts them erases the evidence
A single poisoned document plants a standing instruction that survives every reset
Encoded public text is laundered across an agent handoff into an on-chain transfer
A screenshot that's harmless at full size becomes an order once the system shrinks it
The eval gate that was supposed to catch the agent is itself the thing being attacked
A poisoned web page hijacks a research agent — and the planner acts on its behalf
An inbox summary quietly ships a secret to an attacker's server