A security vulnerability in Cursor's command-line coding agent allowed a cloned repository to execute arbitrary commands on a developer's computer before any trust prompt appeared, and operated outside the sandbox even when that protection was explicitly turned on. Manifold Security disclosed its findings on August 10, three weeks after reporting the issue to Cursor on July 20. The flaw bypassed the agent's isolated worktree feature, which was designed to keep AI operations separate from a developer's active files.
Francisco Rosales, an offensive security engineer at Manifold, discovered the issue in the worktree flag's behavior. When a developer started the agent with the worktree flag, the system created a clean checkout and ran a setup step automatically. That setup step pulled a configuration file from the repository and fed its contents directly into a shell with no parsing, no restrictions, and no user confirmation. The file came through a standard clone operation, making it indistinguishable from routine code. According to the security firm, the command had no limits: it could read SSH keys, grab cloud credentials from environment variables, open reverse connections, or install persistent backdoors. The setup ran under a hardcoded policy that Cursor internally uses to disable the sandbox entirely, and switching on the sandbox flag didn't change that. Cursor had already fixed this type of vulnerability once before—in 2025, a repository file in the same location auto-launched an attacker's server when opened, earning the designation CVE-2025-64109 with a severity rating of 8.8 out of 10. The worktree feature shipped five months after that patch with the same underlying mechanism.
Manifold submitted the vulnerability through HackerOne with proof-of-concept code and a screen recording. Cursor released a new build on July 23 that placed the setup command behind the trust prompt. Six days later, the company closed the submission as "informative," a classification meaning no security impact. The report states that Cursor gave two justifications: exploitation requires a user to clone or open a repository controlled by an attacker, and the finding didn't demonstrate a bypass of workspace trust. Manifold countered that cloning repositories is the product's core function and was equally a requirement for CVE-2025-64109. The difference between the two vulnerabilities, the security firm argued, was which file carried the malicious command, not what that command could accomplish. Cursor published no advisory with the fix, and the build doesn't appear in the company's July changelog, even though Cursor has issued advisories for this pattern twice in the past.
Developers who use the worktree flag need to update to build 2026.07.23-e383d2b or newer, or use the documented option that skips the worktree setup process altogether. Updating fixes the pre-trust window but leaves the sandbox gap open, which Manifold says persists in current builds. Infosecurity Magazine contacted Cursor for comment on why the report was closed and why no advisory was released, and will update when the company responds. The absence of a public advisory means developers still running affected versions won't receive notification through the usual security channels, leaving those installations exposed unless administrators independently discover the need to upgrade. For development teams relying on AI coding agents to handle untrusted code, the incident shows how repository-triggered execution can slip through protections designed to isolate automated operations from sensitive systems.