Image by Sigmund, from Unsplash
Cursor AI Code Editor Flaw Lets Hackers Run Code Automatically
Reading time: 2 min
Last Updated: Sep 11, 2025
-
![Kiara Fabbri]()
-
![Sarah Frazier]()
Fact-Checked by Sarah Frazier Content Manager
More than one million developers use Cursor as their AI code editor but the tool has been found to contain a critical security flaw.
In a rush? Here are the quick facts:
- Cursor AI editor runs malicious code from repos without user consent.
- Workspace Trust is disabled by default in Cursor.
- Cursor refuses to change default settings despite warnings.
According to Oasis Security, the security flaw in Cursor enables attackers to execute malicious repository code automatically as developers open their projects, with no clicks or confirmation required.
Cursor is based on Visual Studio Code (VS Code) but ships with an important security feature, Workspace Trust, turned off by default. In this way, attackers can embed malicious files into project folders which execute automatically the moment users access the folder.
That code could steal credentials, API tokens, and configuration files, or even connect to hacker-controlled servers. BleepingComputer noted that because developers’ laptops often store cloud keys and permissions, creating an entry point for attackers to spread their attacks into corporate systems.
VS Code itself is not affected because it blocks these automatic runs unless the user explicitly grants trust. To demonstrate the danger, Oasis shared a proof-of-concept showing how a simple task could send a developer’s username to an external server.
Cursor, however, has no plans to change its default settings. The company explained that “Workspace Trust disables AI and other features our users want to use within the product.” Instead, it says it will update security guidance to help users enable Workspace Trust manually if they choose.
For now, Oasis Security advises users to activate Workspace Trust in Cursor while conducting project searches for autorun tasks, and testing unknown repositories inside virtual machines.
“This has the potential to leak sensitive credentials, modify files, or serve as a vector for broader system compromise,” Oasis warned.
Latest articles 
