Rogue MCP Servers Exploit Vulnerability in Cursor Code Editor
Article Content
Browse articles 
Security researchers have identified a vulnerability in Cursor, an AI-powered code editor, that allows rogue Model Context Protocol (MCP) servers to inject malicious code into its internal browser. This exploit can replace legitimate login pages with attacker-controlled pages, compromising user security. The lack of integrity verification in Cursor's features makes it particularly susceptible to such attacks.
Ask AI about this cluster
Answers cite the sources they use
Updated 218d ago How this analysis works
More articles in this cluster (2)
Following this threat?
Track XWorm, Cursor and CVE-2025-64446 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Cybercriminals Use Fake AI Agents to Steal Crypto Wallets Cybercriminals are exploiting interest in Agentic AI by creating fake AI trading agents to lure crypto users into downloading malware. This malware, known as Needle Stealer, replaces legitimate browser wallet extensions like MetaMask and Coinbase with malicious versions that capture user credentials. The attacks were… 
XWorm RAT Transforms into Advanced Surveillance Tool The XWorm Remote Access Trojan (RAT) has evolved into a sophisticated surveillance platform, according to cybersecurity firm Netskope. Initially identified in 2022, XWorm now includes 46 plugins, up from 35 in July 2025, enabling capabilities such as GPS location tracking, live audio streaming, and webcam access.…