Popular AI Coding Tool Cursor Runs Malicious Files Automatically, Researcher Warns
A security firm reported the flaw seven months ago and got silence. Now it's gone public.
Key points
- Offensive security firm Mindgard disclosed a vulnerability in the Cursor AI coding tool on 15 December 2024 and received no patch or acknowledgement for seven months.
- The flaw causes Cursor to automatically run any file named "git.exe" placed in the root folder of a code project, with no warning to the developer.
- A criminal could publish a poisoned code project online and trigger the attack the moment a developer opens it in Cursor.
- On 13 July 2026, a Cursor spokesperson told Dark Reading the company is "addressing this" but gave no timeline.
- Until a fix arrives, Mindgard advises developers to open untrusted projects only inside an isolated virtual machine, a sealed-off computer environment that runs inside your real computer.
Cursor is an AI-powered coding tool used by software developers to write and manage code faster. When you open a project in Cursor, the program quietly looks for Git, a standard piece of software that tracks changes to your work. It checks several folders for Git, and one of them is the project folder itself.
That's the problem.
If someone places a malicious file named "git.exe" in the top-level folder of a code project, Cursor finds it, treats it as legitimate, and runs it automatically. No pop-up appears. No permission prompt follows.
How easy is this to exploit?
Very easy, according to Mindgard. The firm's researchers took the Windows Calculator app, renamed it "git.exe", dropped it into a project folder, and opened that project in Cursor. The Calculator launched on its own, with nothing else required.
Replace the Calculator with ransomware, which is malicious software that locks a victim's files until a payment is made, or software that hands a criminal quiet control of a machine. The effect is identical: execution happens the instant a developer opens the project.
Aaron Portnoy, chief product officer at Mindgard, put it plainly. "If you take a remote access Trojan, a ransomware binary, or whatever you want to execute and just call it git.exe, it runs unrestricted on the developer's machine as soon as they open the repo," he told Dark Reading. He added that fixing the flaw would take him roughly five minutes if he had access to the code.
The attack is especially dangerous because developers routinely download and open code projects shared publicly online. One poisoned repository is all it takes.
This is the kind of supply-chain trap we've been tracking across AI coding tools since late May: our 9 July story on file-planting attacks against AI assistants showed a very similar mechanism, and the pattern hasn't slowed.
Mindgard contacted Cursor by email and through HackerOne, a platform where researchers submit bug reports to software companies. Cursor never accepted the report or confirmed any fix. After seven months, Mindgard went public.
Should developers change how they work right now?
Yes, and the guidance splits by environment. Administrators on managed Windows systems can use AppLocker or Windows App Control, both built-in Windows policy tools, to block "git.exe" from running inside project folders. The consumer-side advice is blunter: don't open any project you didn't build yourself outside an isolated virtual machine until Cursor issues a patch. Don't rely on file hash blocklists for this one.
