CursorJack Vulnerability Exposes Code Execution Risks in AI Development Environments

Proofpoint Threat Research has identified a vulnerability named CursorJack that exploits deeplinks in the Cursor Integrated Development Environment (IDE). This method allows attackers to potentially execute arbitrary code or install malicious components by manipulating Model Context Protocol (MCP) deeplinks. The exploitation requires user interaction, specifically clicking on crafted links and approving installation prompts. The findings indicate that the deeplinks can be disguised as legitimate, posing risks to developers who often operate with elevated permissions. The research highlights the need for improved security measures in the MCP ecosystem, as the current reliance on user vigilance is insufficient. No automatic exploitation was observed, but the potential for abuse remains significant. Proofpoint has published a proof-of-concept code on GitHub and notified Cursor through its vulnerability-reporting channel, which classified the report as out-of-scope. The vulnerability is particularly concerning for environments that utilize AI tools, where users may be conditioned to accept prompts without thorough review.

Key Points: • CursorJack exploits MCP deeplinks in the Cursor IDE, allowing potential code execution. • User interaction is required for exploitation, increasing risk due to social engineering. • Proofpoint recommends security improvements to the MCP framework to mitigate risks.