Two Clicks to Own a Developer's Machine: The Cursor AI Flaw You Should Know About

Key points

• Researchers at Adversa AI disclosed two vulnerabilities in Cursor AI on 15 July 2026, affecting a tool used by more than 50,000 companies worldwide.
• The attack chain requires just two clicks from the victim and can install a malicious MCP server (a privileged software component that connects AI tools to a computer's files and commands) without the developer realising.
• Cursor AI confirmed the bugs were mishandled by a third-party security vendor and said it has since reopened the investigation.
• A separate Cursor flaw involving hidden malware inside a fake Git file was disclosed by Mindgard on 14 July 2026.
• No patch has been publicly confirmed as of publication.

Cursor AI is built around artificial intelligence and used inside 64 percent of Fortune 500 companies, according to the product's own website. On 15 July 2026, Adversa AI published findings shared first with Dark Reading: anyone who can send a link to a Cursor user can, in two clicks, install malicious software on that person's work computer.

The attack uses an MCP server. MCP stands for Model Context Protocol, a standard that lets AI assistants reach outside their sandboxed environment and talk to real systems: read files, call web services, run commands. When a developer installs one in Cursor, it runs with the same permissions as that developer. That's a lot of trust.

How did the attackers do it?

They didn't pick a lock. They forged a parcel label.

Using a technique called double URL encoding, where characters in a web address are swapped for code that browsers quietly translate back, the researchers disguised an MCP install command as a routine pull request link. Pull requests are the messages developers send each other to say "I've changed some code, please review it." Developers click them without thinking.

Click the disguised link and Cursor pops up a small box: "Install MCP server?" It shows the server name and a preview of its commands. That preview is the second flaw. The window is too small to show the full instruction. A malicious command dozens of characters long looks innocent at the top; the dangerous portion sits hidden below the visible area. The developer clicks confirm, and the server installs. It can then read source code, steal stored credentials, or reach further into the employer's network.

Lead researcher Rony Utevsky told Dark Reading this belongs to a class of flaws called argument injection, where hidden commands piggyback on trusted ones. He noted that a similar flaw in Anthropic's Claude Code was found and patched in May 2025, and that Cursor hadn't yet patched either issue at the time of disclosure. Utevsky added: "AI coding tools are rebuilding the consent prompt from scratch and, so far, treating it as the whole defense."

This is the third Adversa AI vulnerability campaign we've covered since 30 June, including their finding that ten of eleven open-source coding agents fall to a shell bypass that any sysadmin would recognise. The pattern is consistent: old attack classes, new surfaces, consent prompts that weren't designed to carry the full defensive load.

Cursor told Dark Reading a third-party security vendor had wrongly closed the original bug report. The company has since reopened it and is investigating.

What matters most here isn't the cleverness of the encoding trick; it's that the consent dialog is being treated as a complete security boundary when it isn't one. Watch whether Cursor ships a fix that requires signed, verified MCP sources rather than just resizing a text box.

Should you worry?

Yes, if your developers use Cursor and install MCP servers from links. Treat any unsolicited link that triggers an MCP installation prompt as suspicious, even if it appears to come from a colleague. Scroll the full command in any confirmation box before clicking approve, and if you can't see all of it, don't proceed. Ask your security team to allowlist only pre-approved MCP servers and block unknown ones at the network level.