Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise NEWSLETTER SIGN-UP Cybersecurity Topics World The Edge DR Technology Events Resources APPLICATION SECURITY CYBER RISK ENDPOINT SECURITY REMOTE WORKFORCE NEWS 2-Click Cursor Exploit Enables Dev Environment Takeover Simple age-old bugs give bad actors access to developers' secrets and source code-rich environments. Nate Nelson,Contributing Writer July 15, 2026 6 Min Read SOURCE: ANDRIY ONUFRIYENKO VIA GETTY IMAGES A popular artificial intelligence (AI) coding tool can be exploited in just two clicks, allowing attackers to install permission-rich model context protocol (MCP) servers on privileged developers' machines. Much has been made of the cybersecurity risks in coding with AI. This week, researchers have been highlighting a higher-order issue: vulnerabilities in AI coding environments themselves. In particular, they've been picking apart the fastest-growing AI code editor, "Cursor AI." Any issue with Cursor has major potential since, according to its website, the program is used by more than 50,000 enterprises, including 64% of the Fortune 500. Its valuation exploded earlier this year, thanks to good revenue numbers and an acquisition by SpaceX. LOADING... On July 14, Mindgard revealed that Cursor AI can be exploited rather simply, by concealing malware in a fake Git file. One day later, researchers at Adversa AI unearthed two more vulnerabilities in the same platform. In a report shared exclusively with Dark Reading, they described a combination of two old-fashioned vulnerabilities that combine to let an attacker install malware on a victim developer's machine, in the form of a malicious MCP server. Related:Cursor IDE Auto-Executes Malicious Code in Poisoned Repos Sneaking a Malicious Server Into Cursor AI MCP servers are made of executable code. They're built to connect AI models to external tools like application programming interface (API) calls, filesystem operations, and more. And, in practice, they're often run with little restriction. In Cursor, for example, when a user installs an MCP server, it executes commands with the same privileges as the user who installed it. When used as intended, MCP servers are powerful tools for getting the most out of AI agents. Viewed maliciously, these same three qualities can make them supercharged backdoors. The goal of Adversa AI's latest project was to get a malicious, crafted MCP server into a victim's Cursor AI integrated development environment (IDE). If they could achieve that, they would be able to run arbitrary commands without regard for any kind of sandboxing. In theory, those arbitrary commands could involve stealing source code or secrets, or infecting the developer's employer. LOADING... Doing that required a deeplink, which would trigger a protocol handler for installing a new MCP server in Cursor. But MCP servers aren't arbitrary things developers install and uninstall willy-nilly — nobody would click a link they weren't expecting if it read "mcp/install." The researchers figured they had to conceal it in some less interesting package, to make it more blindly clickable. Related:AI Coding: Do Security Risks Outweigh Productivity Gains? One sort of thing that developers might randomly click are pull requests from their colleagues — quick code changes that come hard and fast during development cycles. So the researchers used double URL encoding to turn their MCP install deeplink into a blob of text embedded inside of a pull request link. Thus, what appeared to be a standard pull request to a developer would, in fact, conceal an MCP installation instruction for Cursor AI. Rony Utevsky, lead researcher at Adversa AI, says the mere fact that a link like this can lead to untrusted code execution is problematic — reminiscent of argument injection flaws seen all around the software world for ages. "It's a general, old class, not specific to AI tools," he says, and AI platforms have been recreating it one after the other. "Claude Code shipped a one-click argument injection RCE in exactly this class, disclosed and patched in May. Codex is lower-risk by design because its deeplink only pre-fills the prompt box — nothing runs until you hit Enter. Copilot deliberately confirms before acting." Size Matters in Pop-Up Fields The victim developer is not doomed yet. If they click that link, a dialog box will pop up inside of their IDE. Instead of presenting as a pull request, Cursor will ask if they want to install an MCP server. An attentive victim might notice something is awry at this point and quit out of the infection flow. Yet there are two good reasons they might not. Related:Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft "The natural pretext [is one] developers already accept," Utevsky argues. Developers might have to set up new tools to work on a repo, among which could be a new MCP server. "Installing MCP servers from a link is a flow Cursor actively encourages, that's why the deeplink exists in the first place." The second more troubling, yet more fixable reason why a victim might approve a malicious MCP install is thanks to the presentation of Cursor's pop-up dialog itself. They'll be presented with a confirmation to "Install MCP server?" plus the name of the server they're installing. But the "Argument" field of this confirmation message — where the server's malicious commands lay — contains only room enough to view a brief line of code. That makes it trivial to show one's victim a seemingly legitimate bit of code, and hide all the malicious stuff offscreen, as seen in the GIF below. Source: Adversa AI Utevsky laments that "browsers and operating systems spent two decades building defense-in-depth behind the consent prompt. That's where code signing, mark-of-the-Web, and sandboxing came from. AI coding tools are rebuilding the consent prompt from scratch and, so far, treating it as the whole defense." "It's less that the AI industry is uniquely careless," he adds, "and more that it's shipping fast, gating a maximally dangerous action, and hasn't yet added the layers everyone else learned to put behind the prompt." Defending Your IDE Adversa AI filed two bug reports with Cursor AI: one for the argument injection issue, and one regarding the dialog box inadequacy. Apparently they weren't the first researchers to file a report about the former issue. The latter issue, apparently, was raised internally at Cursor, on April 27. A representative from Cursor tells Dark Reading that they've since tracked these issues as a single vulnerability. "This bug was reported to our third-party security vendor, who erroneously closed it. We've since reopened it, are investigating, and will take appropriate steps to address it." In the meantime, Adversa recommends that organizations tighten up their MCP security: allowlisting only approved servers, filtering install and execution routes in Cursor, and using detection as a fallback plan. "The hard problem in agentic AI security is that allowlisting and gateways are the necessary first layer, but the dangerous thing here isn't any single step, it's the chain of events," Utevsky says. "A link, a dialog, a config, an MCP install — each looks plausible on its own. Any tooling that sees only one step, with no memory of what the user was actually shown and agreed to, will miss attacks." "The controls that will matter are agent-aware: ones that treat the whole chain of agentic actions, MCP traffic included, as a single unit, and can break the ones where what-executed diverges from what-was-approved," he says. "Most organizations aren't there yet, but this is the direction the surface is forcing everyone toward." About the Author Nate Nelson Contributing Writer Nate Nelson is a journalist and award-winning scriptwriter. In addition to Dark Reading he writes for Darknet Diaries, the most popular show in cybersecurity across all media. He began his career as a freelancer, ghostwriting Forbes and CNBC op-eds for executives in tech and finance. Then he transitioned to journalism at Threatpost, where he covered cybersecurity news and trends. Throughout those years he co-created a cybersecurity podcast, Malicious Life, which in its day climbed into the Top 20 technology podcasts charts on Apple Podcasts and Spotify. He holds degrees from New York University and Bard College. As a born and bred New Yorker, he enjoys a superiority complex, but is polite enough to keep it to himself. Want more Dark Reading stories in your Google search results? ADD US NOW More Insights Industry Reports The State of Cloud Security: The Latest Challenges How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy Essential News & Insights from Black Hat USA 2025 Access More Research Webinars When AI Becomes an Insider: Rethinking Risk in Critical Infrastructure Governing the Agent; Identity Security in the Age of Autonomous AI Securing the AI Era: Shadow AI, AI Agents, and Why AI Detection and Response Changes Everything Practical Zero Trust Implementation on a Budget in the Age of Mythos Building a Risk Based Vulnerability Management Program More Webinars You May Also Like APPLICATION SECURITY Supply Chain Attack Secretly Installs OpenClaw for Cline Users by Rob Wright FEB 19, 2026 APPLICATION SECURITY Chinese Hackers Hijack Notepad++ Updates for 6 Months by Jai Vijayan FEB 02, 2026 APPLICATION SECURITY Trump Administration Rescinds Biden-Era Software Guidance by Alexander Culafi JAN 29, 2026 APPLICATION SECURITY Microsoft Fixes Exploited Zero Day in Light Patch Tuesday by Jai Vijayan DEC 09, 2025 Editor's Choice CYBERSECURITY OPERATIONS 'Yellow Teams' Are Defining the Future of AI Security byNate Nelson JUL 13, 2026 6 MIN READ CYBERSECURITY OPERAT