A flaw in Cursor’s command-line coding agent has been found to allow a cloned repository to run any command it chose on a developer’s machine before they were asked whether they trusted it, and outside the sandbox even when the sandbox had been explicitly switched on.
Manifold Security said it reported the issue to Cursor on July 20 and published its findings on August 10. Cursor shipped a fix for the pre-trust behavior three days after the report, then closed the submission as informative, meaning no security impact, and published no advisory.
Francisco Rosales, offensive security engineer at Manifold, found the issue in the agent’s isolated worktree feature, which exists to keep an AI agent away from a developer’s working tree.
Read more on repository-triggered execution: Cursor Autorun Flaw Lets Repositories Execute Code Without Consent
Same Directory, Same Primitive
Starting the agent with the worktree flag creates a fresh checkout with no build output in it, so the agent runs a setup step by default. That step read a tracked configuration file out of the repository and passed its contents straight to a shell, with no parsing, no allowlist and no prompt.
The file arrived with an ordinary clone, so nothing about the delivery looked unusual. Manifold noted the command was unconstrained: reading SSH keys, taking cloud credentials from the environment, opening a reverse shell or writing persistence were all available.
The setup step also ran under a policy Cursor internally names for disabling the sandbox entirely, and that value is hardcoded on this path. Passing the flag to enable the sandbox did not override it.
Cursor had already patched this class once. In 2025, a repository-supplied file in the same directory auto-started an attacker’s server on open, becoming CVE-2025-64109, rated high at 8.8. The worktree feature shipped five months after that fix carrying the same primitive.
Fixed in Three Days, Then Closed as Informative
Manifold submitted the report through HackerOne with a proof-of-concept (PoC) repository and a screen recording. A new build followed on July 23 that moved the setup command behind the trust prompt.
Six days later the report was closed as informative. Manifold said Cursor gave two reasons: that exploitation requires the user to clone or open an attacker-controlled repository, and that the report did not demonstrate bypassing workspace trust.
Manifold’s response was that cloning repositories is what the product is for, and was equally a precondition of CVE-2025-64109. The two findings differ in which file carried the command, it argued, not in what the command could do.
No advisory accompanied the fix, and the build does not appear in Cursor’s July changelog. Manifold pointed out that Cursor has published advisories for this pattern twice before, and that an advisory is the channel that reaches users still running affected versions.
Developers using the worktree flag should update to build 2026.07.23-e383d2b or later, or pass the documented flag that skips worktree setup entirely. Updating closes the pre-trust window but not the sandbox gap, which Manifold said remains on current builds.
Infosecurity Magazine has approached Cursor for comment on the report’s closure and the absence of an advisory, and will update this article with any response.
