MCP Protocol Bug Let Attackers Execute Code in Cursor

A security vulnerability in artificial intelligence-powered coding environment Cursor enabled silent remote code execution via the model context protocol, found security researchers.

See Also: AI Agents Demand Scalable Identity Security Frameworks

Cursor integrates large language models into the coding workflow and enables users to interact with plugins and external tools through MCP, an open-source protocol introduced by Anthropic last year. MCP facilitates structured communication between agents, such as AI tools, and external data sources. Security researchers have already found multiple security flaws associated with it or its implementation (see: Serious Flaws Patched in Model Context Protocol Tools).

Researchers from cybersecurity firm Check Point team discovered that once a developer approved a configuration file for an MCP server in Cursor, any future changes to that file, including malicious ones, could be executed without further prompts. This design meant attackers could inject harmful commands into a previously trusted project, triggering code execution whenever the project was reopened.

“The flaw exposes a critical weakness in the trust model behind AI-assisted development environments, raising the stakes for teams integrating LLMs and automation into their workflows,” Check Point wrote in analysis published Tuesday.

Check Point researchers Andrey Charikov, Roman Zaikin and Oded Vanunu said they set out to evaluate whether the trust and validation model for MCP execution in Cursor properly accounted for changes over time, especially in cases where a previously approved configuration is later modified. “In collaborative development scenarios, such changes are common – and any gaps in validation could lead to command injection, code execution, or persistent compromise,” they said in the technical write-up, also published Tuesday.

To exploit the flaw dubbed MCPoison by Check Point, an attacker could insert a benign configuration file containing a non-malicious command into a shared project. After it’s approved by a collaborator, the attacker can replace that file with one executing malicious code. Since Cursor did not revalidate changes to already-approved configurations, it would trust the updated file and run the new command without user confirmation.

This results in a persistent remote code execution scenario that could be used to compromise systems silently, particularly dangerous in team environments where projects are frequently cloned, shared or reused, the researchers said.

Check Point disclosed the issue to Cursor on July 16, which released a patch in version 1.3 of Cursor later that month. The updated release now prompts users to manually approve every change to MCP server configurations.

Check Point said that the Cursor issue is part of a larger class of security problems associated with AI-enhanced development platforms. The researchers argue that MCP is powerful in enabling cross-agent workflows and extensibility, but creates new risks that developers and security teams may not yet be fully equipped to manage.