Cursor closes command execution gap before workspace trust

Cursor has patched a security flaw in its command-line coding agent that allowed a malicious repository to execute commands on a developer’s computer before the user was asked whether the workspace should be trusted.

The weakness affected Cursor CLI’s worktree feature and could be triggered when a user launched the agent with the -w option inside a repository containing a specially crafted. cursor/worktrees. json file. The file could specify a shell command that was executed during worktree setup before Cursor displayed its Workspace Trust prompt.

Security researchers disclosed the issue to Cursor on July 20 after demonstrating that repository-controlled commands could run with the privileges of the logged-in user. Cursor released cursor-agent build 2026.07.23-e383d2b on July 23, changing the sequence so that the trust prompt appears before the setup command is permitted to run.

The finding was made public on August 10 by Manifold Security, whose testing showed that older builds could execute arbitrary shell commands supplied through the repository configuration. The company demonstrated the behaviour using a harmless command that opened a calculator application, establishing that code execution had already occurred before the user was asked to trust the workspace.

The vulnerable path was connected to Cursor CLI’s isolated worktree functionality. When a worktree was created, the software checked. cursor/worktrees. json for a setup-worktree instruction intended to initialise the development environment. Earlier versions passed that value to the system shell during workspace resolution, which occurred before the trust check.

That ordering created a potentially serious security problem because an attacker-controlled repository could contain the configuration file as ordinary tracked content. A developer cloning the project and starting Cursor Agent with the worktree option could therefore execute a command chosen by the repository author without first approving the repository.

Such commands would run with the developer’s user privileges and could theoretically access files available to that account, environment variables, development credentials and other local resources. The weakness did not require manipulation of the artificial intelligence model itself. The execution stemmed from application logic surrounding repository setup.

The issue was complicated by Cursor’s sandbox handling. Testing found that the worktree setup command used a policy that disabled sandbox restrictions even when a user invoked Cursor Agent with sandboxing enabled. Cursor’s July 23 update corrected the pre-trust execution order, but the setup process can still operate outside the sandbox after a user explicitly trusts the workspace.

Developers who want to prevent repository-defined setup scripts from running can use the –skip-worktree-setup option. Users of the worktree feature are also being advised to run the July 23 build or a later version, since earlier releases retain the pre-trust behaviour.

Cursor’s Workspace Trust mechanism is intended to separate trusted development projects from unfamiliar code. When enabled, it asks users whether they trust a new workspace before allowing potentially dangerous functionality. Cursor’s documentation says the feature is disabled by default in the broader product and can be enforced across organisations through device-management policies.

The company also describes terminal command approval, configuration-file restrictions and sandboxing as safeguards for agent activity, while warning that some controls are best-effort protections rather than absolute security boundaries.

The Manifold disclosure highlights a growing security challenge facing AI coding platforms. Modern development agents can read repositories, modify files and invoke operating-system commands, making the point at which software moves from inspecting untrusted content to executing it increasingly important.

Cursor faced scrutiny over another repository-triggered execution issue earlier this year involving a malicious git. exe file placed at the root of a project on Windows. That case renewed debate over how AI development tools should treat repositories that users deliberately open but whose contents have not been individually inspected.

The latest worktree issue also resembles an earlier Cursor CLI vulnerability involving repository-controlled Model Context Protocol configuration. That flaw, tracked as CVE-2025-64109, allowed an MCP server command contained in. cursor/mcp. json to execute when a cloned project was opened. It received a high-severity CVSS score of 8.8 and was patched in 2025.