All posts
Scope Drift

DuneSlide: Cursor's Sandbox Trusted the Model

Cato AI Labs disclosed two zero-click Cursor RCEs where LLM-controlled inputs reach sandbox write policy and overwrite the sandbox helper

Securityv0 Intelligence Team OWASP: ASI03 sv0 finding: scope_drift
duneslide cursor prompt-injection sandbox-bypass scope-drift ai-coding-agent

The Incident

On July 1, 2026, Cato AI Labs publicly disclosed DuneSlide — two critical remote-code-execution vulnerabilities in Cursor, tracked as CVE-2026-50548 and CVE-2026-50549 and rated CVSS 9.8 (v3.1) / 9.3 (v4.0). Both were patched in Cursor 3.0, released April 2, 2026; every earlier version is affected. Cato reports no known in-the-wild exploitation as of disclosure. The chain is zero-click: an attacker never touches the developer’s keyboard. Instead, they plant instructions in content the Cursor agent ingests on the developer’s behalf — a page returned by a web-search tool, a description served by a connected MCP server, or an in-repo file the agent reads while working on a normal request.

The two CVEs are distinct primitives against the same target: Cursor’s cursorsandbox helper, which mediates the agent’s shell tool. CVE-2026-50548 is a working_directory bypass. When the LLM assigns a non-default value to the working_directory parameter on Cursor’s run_terminal_cmd tool, the sandbox appends that path to its allow-write list without validating that it sits inside the project root. A prompt injection can steer the LLM to point working_directory at the sandbox helper’s own directory and use the sandboxed command to overwrite cursorsandbox itself. On macOS the target path is /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox. CVE-2026-50549 is a canonicalization fail-open. Cursor resolves symlinks to confirm the real destination is inside the project root, but when canonicalization fails, the code falls back to trusting the pre-canonicalization path. A prompt injection can direct the agent to create a symlink inside the project pointing at an external file, cause canonicalization to fail, and reach the same cursorsandbox binary. Either primitive collapses the sandbox for every subsequent command; the next shell step executes with the developer’s full user privileges.

The disclosure timeline underlines how the class of defect slipped through review. Cato reported both bugs on February 19, 2026. The initial triage rejected them on February 23 on the grounds that MCP-borne prompt injection sat outside Cursor’s threat model. Cato re-escalated on February 26, and the fixes shipped in Cursor 3.0 on April 2, 2026. Vitaly Simonovich of Cato CTRL is the credited researcher. MITRE ATT&CK coverage: T1068 (Exploitation for Privilege Escalation), T1554 (Compromise Client Software Binary), T1059 (Command and Scripting Interpreter).

The Authority Path That Failed

The identity carrying execution authority at the moment of failure is the Cursor agent process, running as the developer’s local user. The scope it held is the full developer identity — local filesystem, shell, and any cloud or SaaS tokens the editor is signed into. The scope the operator intended the agent’s shell tool to exercise is expressed structurally by cursorsandbox: writes should stay inside the project root and the current working_directory. The scope the agent actually exercised under either DuneSlide primitive is arbitrary filesystem writes — used, in Cato’s chain, to overwrite cursorsandbox itself and collapse the sandbox for every future command.

Two distinct trust anchors fail, and both are the same shape. In CVE-2026-50548 the trust anchor is an LLM-controlled argument (working_directory on run_terminal_cmd) flowing directly into a security-policy decision — the sandbox’s allow-write list — with no independent check that the value is inside the project. In CVE-2026-50549 the trust anchor is a fail-open path validator: canonicalization is the check meant to block symlink escapes, but when the check fails, the code degrades to trusting its input rather than refusing the operation. Both anchors are statically knowable before any attacker attempts them: every LLM-controlled tool argument that reaches a security-policy decision, and every “if the validator fails, trust the raw input” fallback in code that mediates the agent’s authority. The held-versus-exercised gap is not a runtime surprise; it is present in the tool-manifest and sandbox source before the first prompt injection lands.

SecurityV0 Perspective

This is scope_drift (ASI03). The developer authorized Cursor’s shell tool with the sandbox as the technical bound on its exercised scope. Under DuneSlide the tool’s exercised scope drifts past its intended scope because the sandbox — the technical control that was supposed to bound scope — trusted an LLM-controlled argument and a fail-open path validator. The shell tool was authorized; its bounded shape was not. The unproven_execution frame does not fit as cleanly here: the code-execution tool itself was known and named at attach time. What changed at runtime was the perimeter around it.

The evidence pack SecurityV0 would produce names the agent identity, every tool the agent can invoke, and — for each tool — which arguments are LLM-controlled and which of those arguments reach a security-policy decision downstream. It also lists every path-validator and sandbox check that fails open. For an organization running Cursor, the pre-incident question the pack answers is: for the agent’s shell tool, which of its arguments flow into the sandbox’s write-policy decision, and would our approved scope allow the resulting write if the LLM chose the worst possible value? The post-incident question is the operational one: which developer workstations ran a pre-3.0 Cursor build against MCP servers, web-search tools, or repositories with un-vetted content — and of the secrets, cloud tokens, and SaaS sessions those workstations held, which ones need rotation?

What To Do

  • Upgrade Cursor to 3.0 or later across your engineering estate and block older builds at the endpoint. Both CVEs are fixed in 3.0, released April 2, 2026, and every earlier version is affected. Inventory each developer workstation’s Cursor version, force the upgrade through your device-management channel, and configure your endpoint policy to refuse Cursor binaries below the 3.0 boundary — a stale local install is the only prerequisite either primitive needs.
  • Audit every LLM-controlled tool argument that reaches a security-policy decision. DuneSlide’s shape is generic: working_directory on a shell tool feeding a sandbox allow-write list. Extract every tool schema an AI coding agent exposes, mark which arguments the model chooses, and trace which of those arguments end up in a policy decision — write allow-lists, network egress rules, credential-scope selectors. Any that do are DuneSlide-class defects waiting for the next disclosure.
  • Refuse “fail open” fallbacks in path validators that mediate agent authority. CVE-2026-50549 exists because canonicalization degraded to trusting the raw input when it could not resolve the target. In code that mediates an agent’s write scope, a failed validator must refuse the operation, not fall back to the un-canonicalized path. Grep your sandbox and virtual-filesystem layers for if canonicalize failed: use raw-shaped code and rewrite each site to deny.
  • Treat MCP-served content, web-search results, and in-repo files as untrusted input to the agent’s tool arguments — not just to the model’s output. DuneSlide is zero-click precisely because the injected instructions land in content the agent reads on the developer’s behalf. Inventory every content source your agents ingest, tag each with a provenance label the sandbox layer can read, and refuse security-critical tool invocations whose arguments were influenced by untrusted-provenance content.
  • Rotate cloud and SaaS tokens signed into pre-3.0 Cursor builds by any developer who used MCP servers or web-search tools before the upgrade. Cato found no in-the-wild exploitation as of disclosure, but the primitives were reachable for months and leave no forensic trace at the shell layer once cursorsandbox is overwritten. Assume any long-lived token that a pre-3.0 Cursor could reach — AWS keys in the shell environment, GitHub tokens in the credential helper, SSO cookies inside the editor’s account session — is a rotation candidate.

Sources

All posts