{"schema_version":"0.10.0","id":"LR-2026-0445","record_version":1,"title":"CursorJack: MCP deeplink abuse in Cursor IDE (proof of concept)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"b167de5cc2b48041d7b645bc06c555d23033736e21f73aeb47fc09bcc2b16911"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"Cursor IDE with Model Context Protocol (MCP) server installation","tools_granted":[],"permissions_scope":"Commands run with the same privileges as the user","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"evaluation","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-03-17","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Cursor, an AI coding IDE published by Anysphere, Inc., supports installing Model Context Protocol servers through cursor:// deeplinks. Proofpoint Threat Research examined in a controlled test environment whether these deeplinks could be abused. In its proof of concept, a phishing email led to a landing page that triggered an install deeplink. Once the user accepted the install prompt, a command ran on the workstation and opened a Meterpreter session. The install warning was identical for legitimate and malicious deeplinks. The researchers notified Cursor, which closed the report as out‑of‑scope. The work is a proof of concept; the sources state no in‑the‑wild exploitation.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Minor test: contained to the test environments noted, no third party touched, as stated in the source.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/cursorjack-weaponizing-deeplinks-exploit-cursor-ide","publisher":"Proofpoint","date":"2026-03-17","type":"press","title":"CursorJack: weaponizing Deeplinks to exploit Cursor IDE - Proofpoint","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.permissions_scope":"C","system.deployment_context":"C","event.incident_class":"C","event.detection_method":"C","context.industry":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"Cursor implements deeplinks for Model Context Protocol (MCP) to provide a mechanism for installation of MCP servers in Cursor IDE."}],"system.permissions_scope":[{"source_index":0,"quote":"During the installation process, the user is shown a preview of the configuration within an installation dialogue and is prompted that the MCP server will execute commands with the same privileges as the user."}],"system.deployment_context":[{"source_index":0,"quote":"This post reflects Proofpoint Threat Research observations in a controlled test environment as of January 19, 2026."}],"event.incident_class":[{"source_index":0,"quote":"CursorJack is a proof-of-concept demonstrating that MCP deeplinks can be abused for local command execution or to install a malicious remote MCP server."}],"event.detection_method":[{"source_index":0,"quote":"This blog describes CursorJack, a method of potentially abusing Cursor MCP deeplinks that, under certain conditions, could enable code execution or allow installation of a malicious remote MCP server."}],"context.industry":[{"source_index":0,"quote":"Proofpoint does not compete in Cursor’s market segment (AI developer IDE/tools)."}],"impact.severity":[{"source_index":0,"quote":"The behavior described below is specific to the test environments noted and does not imply silent or zero‑click exploitation by default."}],"impact.severity_because":[{"source_index":0,"quote":"The behavior described below is specific to the test environments noted and does not imply silent or zero‑click exploitation by default."}],"event.summary":[{"source_index":0,"quote":"Cursor implements deeplinks for Model Context Protocol (MCP) to provide a mechanism for installation of MCP servers in Cursor IDE."},{"source_index":0,"quote":"Proofpoint has no commercial, customer, partner, or vendor relationship with Cursor (published by Anysphere, Inc.)."},{"source_index":0,"quote":"A phishing email directs the victim to a malicious landing page that triggers an MCP deeplink."},{"source_index":0,"quote":"Cursor executes user-privileged commands when users accept the install prompt."},{"source_index":0,"quote":"Once the user installs the MCP, the malicious installation command is executed."},{"source_index":0,"quote":"However, this warning is identical for all deeplinks, whether they are legitimate links from MCP directory or a malicious crafted deeplink."},{"source_index":0,"quote":"We notified Cursor prior to publication; the report was closed as out‑of‑scope / Not Applicable under their policy."},{"source_index":0,"quote":"The behavior described below is specific to the test environments noted and does not imply silent or zero‑click exploitation by default."}]},"notes_on_gaps":"The source is a vendor-neutral proof-of-concept in a controlled test, not a report of a real-world incident; no real-world exploitation, victims, losses or record counts are stated. No model, agent, autonomy level or lifecycle stage is stated, so agent-related fields are omitted. The header publication date (2026-03-17) is not in the body, so date_disclosed is omitted. No date of occurrence beyond the observation date is given, and no duration. The vendor's response was closure as out-of-scope; no fix is reported. Judgements made: incident_class set to security_compromise; trigger set to human_misuse from the social engineering described; detection set to public_researcher; root_cause set to guardrail because the approval warning was the failing safeguard; responsible_party set to provider based on the vendor's stated design; severity set to minor because the sources limit the behaviour to test environments; near_miss not set; remediations are source recommendations, not changes made by Cursor. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":"AI developer tools","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Cursor IDE supports one-click installation of MCP servers through cursor:// deeplinks.","quote":"Cursor implements deeplinks for Model Context Protocol (MCP) to provide a mechanism for installation of MCP servers in Cursor IDE.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The install dialogue showed the same warning for legitimate and malicious deeplinks.","quote":"However, this warning is identical for all deeplinks, whether they are legitimate links from MCP directory or a malicious crafted deeplink.","source_index":0,"grade":"C"},{"step":"caught","text":"Proofpoint Threat Research found and described the abuse in a controlled test.","quote":"This blog describes CursorJack, a method of potentially abusing Cursor MCP deeplinks that, under certain conditions, could enable code execution or allow installation of a malicious remote MCP server.","source_index":0,"grade":"C"},{"step":"done","text":"Proofpoint notified Cursor, which closed the report as out-of-scope.","quote":"We notified Cursor prior to publication; the report was closed as out‑of‑scope / Not Applicable under their policy.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.proofpoint.com/us/blog/threat-insight/cursorjack-weaponizing-deeplinks-exploit-cursor-ide"]},"analysis":{"sections":{"timeline":[{"text":"Proofpoint Threat Research observations of the CursorJack behaviour were made in a controlled test environment.","quote":"This post reflects Proofpoint Threat Research observations in a controlled test environment as of January 19, 2026.","source_index":0,"when":"2026-01-19"},{"text":"Proofpoint notified Cursor before publication; the report was closed as out-of-scope / Not Applicable.","quote":"We notified Cursor prior to publication; the report was closed as out‑of‑scope / Not Applicable under their policy.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.proofpoint.com/us/blog/threat-insight/cursorjack-weaponizing-deeplinks-exploit-cursor-ide"]}}