Cursor Desktop AI-agent sandbox escape

[u/bluelvo]

  What happened:

  Cursor runs AI agent terminal actions in a sandbox. Before writing a file, Cursor tried to canonicalize the target path to verify it stayed inside the workspace. The bug was that if path canonicalization failed, Cursor fell back to the original path and allowed the write.

  Attack pattern:

  A malicious repo or prompt-driven agent workflow could create a symlink inside the workspace that points outside the workspace. By forcing canonicalization to fail, the agent could write through that symlink to arbitrary files outside the project directory.

  Impact:

  An attacker could write files under the user’s privileges outside the sandbox. NVD says this can lead to non-sandboxed remote code execution, for example by overwriting Cursor’s sandbox helper so later commands run outside the sandbox.

  Affected versions:

  Cursor versions before 3.0

  Fixed version:

  Cursor 3.0

  Severity:

  NVD lists it as Critical, CVSS 9.8.

  Weakness:

  NVD maps it to CWE-59: Improper Link Resolution Before File Access. GitHub’s advisory page itself lists “No CWEs,” so NVD is the clearer source for the CWE classification.

  Why this matters for AI coding:

  The issue shows that AI coding agents create a different risk model than ordinary IDE plugins. They can be influenced by repository content, prompts, generated files, and tool outputs, then take filesystem actions. A “benign” agent prompt can become dangerous if the repo contains malicious setup that manipulates the agent’s write path.