AI Risk Wire

Cases › security breach › LR-2026-0445

CursorJack: MCP deeplink abuse in Cursor IDE (proof of concept)

Preliminary Why: Publisher not yet named · subject to change

Status: action reported, no fix

Severity minor
Reported 17 Mar 2026
Agent tool Cursor IDE with Model Context Protocol (MCP) server installation
Industry AI developer tools

No source states: loss or records, developer and model, could do, deployer.

Severity minor: test: contained to the test environments noted, no third party touched, as stated in the source.

Cursor, an AI coding IDE published by Anysphere, Inc., supports installing Model Context Protocol servers through cursor:// deeplinks. Proofpoint Threat Research examined in a controlled test environment whether these deeplinks could be abused. In its proof of concept, a phishing email led to a landing page that triggered an install deeplink. Once the user accepted the install prompt, a command ran on the workstation and opened a Meterpreter session. The install warning was identical for legitimate and malicious deeplinks. The researchers notified Cursor, which closed the report as out‑of‑scope. The work is a proof of concept; the sources state no in‑the‑wild exploitation.

What happened

1 · What it was doingCursor IDE supports one-click installation of MCP servers through cursor:// deeplinks.
2 · What went wrongThe install dialogue showed the same warning for legitimate and malicious deeplinks.
3 · How it was caughtProofpoint Threat Research found and described the abuse in a controlled test.

What was done

Proofpoint notified Cursor, which closed the report as out-of-scope.

Risks

AI system attacked or breached
Primary23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Similar incidents

Hidden web text hijacks AWS Kiro IDE to run attacker code2026-07-21

All cases of this kind ›

Evidence

No source states: what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 2 items from the primary sources

What happened, in order

  1. 2026-01-19 Proofpoint Threat Research observations of the CursorJack behaviour were made in a controlled test environment.

Not dated in the sources:

  • Proofpoint notified Cursor before publication; the report was closed as out-of-scope / Not Applicable.
Show every field, with its source and grade

The AI system

Software around the model
Cursor IDE with Model Context Protocol (MCP) server installation
C one secondary source states it
What it was allowed to do
Commands run with the same privileges as the user
C one secondary source states it
Stage of use
in testing
C one secondary source states it

What happened

Earliest source we hold
2026-03-17
D inferred by us from the described behaviour, reason shown
Who caught it
an independent researcher or journalist
C one secondary source states it
What went wrong
security breach
C one secondary source states it

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Why this severity
test: contained to the test environments noted, no third party touched, as stated in the source.
D inferred by us from the described behaviour, reason shown

Context

Industry
AI developer tools
C one secondary source states it

LR-2026-0445 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON