Malicious AI agents can escape sandboxes to execute commands via Cursor editor flaws

Summary

The Cursor AI-powered code editor contains two critical flaws that break its terminal command sandboxing mechanism. These vulnerabilities, identified as CVE-2026-50548 and CVE-2026-50549, allow a malicious agent to bypass workspace restrictions and write files directly to sensitive locations on the host system.

By manipulating path parameters or exploiting symlink resolution failures, an attacker can escalate from a restricted sandbox environment to executing commands with the full privileges of the user running the editor. This escape is achieved through minimal interaction, often requiring nothing more than a benign-looking prompt.

Technical details

The first vulnerability, CVE-2026-50548, stems from how the agent manages its working directory. While Cursor runs terminal commands in a sandbox by default, the sandbox grants write access to the command's working_directory. A flaw exists where an agent can modify this parameter to include writable paths outside of the intended workspace. This allows the agent to target sensitive locations for file writes.

The second vulnerability, CVE-2026-50549, targets the path canonicalization process used before a write operation occurs. The editor attempts to resolve target paths to ensure they remain within the workspace boundaries. However, if this canonicalization fails-which can be forced by creating an in-workspace symlink that points outside the workspace and then removing read permissions on that path-the system falls back to writing via the original path without further approval.

In both scenarios, a malicious agent can overwrite the cursorsandbox helper. Once this helper is modified, subsequent commands run without any sandboxing restrictions, resulting in full remote code execution within the user's environment.

Affected products and fixed versions

The vulnerabilities affect all versions of Cursor prior to version 3.0.

Defender guidance

The primary defense against these exploits is an immediate update to Cursor version 3.0. This update implements two critical changes: the sandbox no longer grants write access based on agent-controlled working directories, and canonicalization failures are now treated as untrusted. If a target path cannot be resolved (including cases where read permissions are removed to defeat resolution), the write operation is blocked rather than falling back to the original path.

For organizations deploying AI-integrated development tools, monitor for unusual file system activity originating from code editor processes, specifically attempts to modify system helpers or files outside of standard project directories.