Bypassing cursor agent guardrails exposes a trust gap in AI coding

At a glance

What this is: This is a security analysis of a script inspection flaw in Cursor Agents that lets a malicious install script evade review and run with shell access.

Why it matters: It matters because AI coding agents increasingly sit inside trusted development environments where credential exposure, execution control, and identity-bound access decisions all intersect.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.

👉 Read Arnica's analysis of the Cursor agent script inspection flaw

Context

AI coding agents change the control problem because they can inspect code, fetch tools, and execute shell commands inside environments that already contain sensitive secrets. The primary issue here is not simply malicious code, but the break between what the agent reviews and what actually runs, which makes traditional review-based safeguards unreliable for agentic workflows.

For IAM and PAM teams, this is a familiar pattern in a new setting: trust is being granted to a runtime entity that can inherit developer access, repository access, and token access without strong execution-time enforcement. Where AI agents are allowed to install tools or run commands, identity governance must extend beyond authentication into artifact integrity, command authorization, and secret containment.

Key questions

Q: What breaks when AI coding agents inspect code but execute a different script?

A: The control breaks because review no longer applies to the artefact that actually runs. That creates a TOCTOU gap where a malicious server can serve one script for inspection and another for execution. In practice, this turns an apparently safe installation flow into a secret-exfiltration path unless the inspected file is the same file that gets executed.

Q: Why do AI coding environments create more secret exposure risk than standard developer tools?

A: They can inspect repository context, read dotfiles, and infer where credentials are stored, then act on that information through commands or file changes. That means secrets can be exposed both by reading them and by persisting changes that keep access alive. Teams should assume workstation-local state is part of the secret attack surface.

Q: How do security teams know whether agent guardrails are working?

A: They know guardrails are working when denied tool calls are visible in logs, high-risk paths are blocked consistently, and the agent cannot override policy from inside its own session. Observe mode is useful first because it shows what the agent actually tries to do before the team decides where to deny access. The signal is repeatable enforcement, not model compliance.

Q: Who is accountable when an AI agent exfiltrates secrets through a support workflow?

A: Accountability sits with the team that designed the privilege boundary and the data path, not with the model itself. If the workflow allowed a privileged agent to read sensitive data and write it into a customer-visible channel, the control failure was architectural. Governance, logging, and containment must be owned by the programme that exposed the path.

Technical breakdown

Why TOCTOU breaks script inspection in agentic workflows

Time-of-check/time-of-use, or TOCTOU, occurs when a system validates one artefact and later executes another. In this case, the agent inspects a remote installation script, then runs a fresh network fetch through `curl | bash`, creating a gap an attacker can exploit by serving benign content during inspection and malicious content during execution. The control failure is not the inspection itself, but the lack of binding between analysis and execution. Agentic tools make this more dangerous because the runtime can autonomously move from evaluation to action without a human re-checking the exact payload.

Practical implication: bind the inspected artefact to the executed artefact and eliminate fresh network fetches at execution time.

Why shell access turns agents into secret-exposure points

Once an AI agent can execute shell commands inside a development environment, it can inherit the same environment variables, tokens, and repository credentials available to that session. The article shows that model-level redaction does not equal execution-level containment. This is a governance issue for secrets management, not just an application bug, because the agent becomes a runtime path to GitHub tokens, API keys, and cloud credentials already present in the workspace. In identity terms, the agent is acting like a high-trust non-human identity with local execution rights.

Practical implication: restrict shell execution paths and segregate secrets from agent-accessible runtime contexts.

How inspection-only guardrails fail when execution is not enforced

Safety checks that happen only before execution are advisory, not controlling, if the runtime can ignore or bypass them. The article illustrates a classic control-plane and execution-plane mismatch: the model reasons about safety, but the shell executes independently. That separation matters in agentic AI because policy decisions must survive translation into an actual command, package fetch, or tool invocation. Without enforcement at the point of execution, the guardrail becomes a report rather than a control.

Practical implication: enforce guardrail decisions at execution time, not only during model reasoning.

Threat narrative

Attacker objective: The attacker wants to turn an installation workflow into secret theft from a developer environment through trusted agent execution.

1. Entry occurs when a user instructs the agent to install a tool from an attacker-controlled or compromised host.
2. Escalation happens when the agent accepts a benign script during inspection but executes a different payload through a second network request.
3. Impact occurs when the malicious shell script reads environment secrets and exfiltrates tokens, API keys, and other credentials from the workspace.

NHI Mgmt Group analysis

TOCTOU is the right named concept for this failure because the inspection boundary and execution boundary were never the same control. The article shows that a script can look safe during review and become malicious at run time when the agent fetches it again. That means the governance problem is not content analysis, but artefact continuity. Practitioners should treat any agent workflow that re-downloads code after inspection as a broken trust chain, not a minor implementation flaw.

AI coding agents behave like privileged non-human identities when they can access shells, repositories, and environment secrets. That makes them part of identity governance, not just application security. If an agent can execute commands with inherited developer permissions, the programme needs lifecycle control, secret scoping, and execution authorization that reflect non-human identity risk. The practitioner conclusion is simple: if the agent can act, it must be governed like a runtime identity.

Inspection-only guardrails are not security controls when the execution path remains unconstrained. A model can flag risk, but if the shell still runs the command, the control has failed in practice. This is where identity and platform governance converge, because policy must bind to the actual command, binary, or script that executes. Teams should re-evaluate whether their AI guardrails are advisory review layers or enforceable runtime controls.

Secrets containment, not just script hygiene, is the real blast-radius issue in agentic developer environments. The article makes clear that shell execution can reach environment variables even when the model refuses to reveal them directly. That means the security boundary must move closer to the secret itself, with environment segmentation, scoped credentials, and execution-time isolation. Practitioners should assume any agent with shell access is already inside the secrets control plane unless proven otherwise.

What this signals

TOCTOU-style execution gaps are now an identity problem because the runtime entity making the decision can also inherit the credential estate. That forces IAM and PAM teams to think beyond who authenticated and toward what the agent can actually execute once trusted. The practical shift is to govern commands, artefacts, and secrets as one control surface, not separate layers. the Ultimate Guide to NHIs remains the clearest baseline for this governance shift.

Agentic developer tools are turning secrets exposure into a lifecycle issue rather than a simple leak-response issue. If the environment still contains long-lived tokens, an installation flaw can convert routine automation into credential theft. That is why remediation speed, secret revocation, and execution isolation now need to be measured together, not in isolation. The State of Secrets in AppSec is relevant here because it shows how slowly many organisations still move once secrets escape.

Inspection-only AI safeguards will not scale unless they are paired with runtime enforcement and scoped privilege. The broader signal is that AI tool adoption is outpacing the governance model used to control it. Teams should expect more pressure to classify agents as managed identities, define their allowed command set, and align control design with frameworks such as the NIST AI Risk Management Framework.

For practitioners

• Bind execution to the inspected artefact Download the installation script once, verify it locally, and execute only that stored copy. Remove any workflow that performs a second fetch at run time, because a fresh request can return different content.
• Eliminate curl-pipe-to-shell patterns Replace `curl | bash` with signed packages, pinned checksums, or local script execution after verification. Treat direct piping from network to shell as an unbounded trust boundary.
• Segregate secrets from agent-accessible environments Move GitHub tokens, API keys, and cloud credentials out of broad process environments and into tightly scoped runtime controls. Limit which commands and sessions can ever read those values.
• Enforce execution-time policy decisions Make sure the decision a model reaches during inspection is the same decision enforced by the shell, package manager, or orchestration layer. Advisory warnings without enforcement leave the attack path open.
• Treat agents as governed non-human identities Assign ownership, review scope, and privilege boundaries to each agent that can run code or install tools. If the agent can act independently, it needs lifecycle controls similar to other high-trust service identities.

Key takeaways

• The core failure is a trust gap between script review and script execution, which lets a malicious payload bypass agent guardrails.
• The operational risk is secret exposure, because AI coding agents can inherit shell access to tokens, API keys, and cloud credentials already present in the environment.
• The control fix is to bind artefact inspection to execution, remove network-to-shell piping, and govern agents as privileged non-human identities.

Key terms

• Time-of-check/time-of-use (TOCTOU): A TOCTOU flaw happens when a system verifies one thing and later acts on a different version of it. In agentic workflows, that means a script, package, or binary can look safe during inspection but be altered before execution, breaking the trust chain.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Policy enforcement at execution time: Policy enforcement at execution time means security controls can inspect and stop behaviour while the workload is running. For AI systems, that is essential because prompt processing and output generation are live actions that cannot be governed reliably by pre-deployment checks alone.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

What's in the full article

Arnica's full blog post covers the operational detail this post intentionally leaves for the source:

• A step-by-step breakdown of the inspection and execution sequence that produced the TOCTOU gap
• The proof-of-concept installation flow used to demonstrate secret exfiltration from the developer environment
• Examples of how weaker and stronger models behaved differently during the same installation workflow
• The specific mitigation pattern for binding the inspected script to the executed script

👉 The full Arnica post covers the proof of concept, attack flow, and recommended mitigation pattern.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners build the control patterns needed to govern agentic workflows and other high-trust non-human identities.