TL;DR: Cursor Agents can be tricked by a time-of-check/time-of-use flaw where a benign installation script is inspected first, then replaced at execution with malicious shell code that exfiltrates secrets from developer environments, according to Arnica analysis. The finding matters because AI coding agents can carry privileged repository, token, and cloud access into runtime decisions, turning inspection-only guardrails into a brittle control boundary.
At a glance
What this is: Arnica reports that Cursor Agents can be tricked into running a different installation script than the one they inspected, creating a TOCTOU gap that can expose developer secrets.
Why it matters: This matters because AI coding agents increasingly operate with repository, token, and cloud access, so inspection-only guardrails are not enough if execution can fetch fresh, unverified code.
Context
AI coding agents change the trust boundary inside development environments because they can fetch code, run shell commands, and touch secrets without the human reviewer seeing each execution step. A time-of-check/time-of-use flaw appears when the thing inspected is not the thing executed, which turns a seemingly safe workflow into an execution-time trust gap.
In this case, the governance issue is not whether the agent can reason about risk, but whether its decision is bound to the exact artifact that reaches the shell. That distinction matters for NHI governance because agent workflows often inherit repository access, environment variables, and other machine credentials that expand blast radius if execution control is loose.
The reported failure pattern is typical of agentic and automation-heavy developer tooling: security checks that happen before execution can be bypassed when execution re-fetches content from the network.
Key questions
Q: What breaks when AI coding agents inspect code but execute a different script?
A: The control breaks because review no longer applies to the artefact that actually runs. That creates a TOCTOU gap where a malicious server can serve one script for inspection and another for execution. In practice, this turns an apparently safe installation flow into a secret-exfiltration path unless the inspected file is the same file that gets executed.
Q: Why do AI coding environments create more secret exposure risk than standard developer tools?
A: They can inspect repository context, read dotfiles, and infer where credentials are stored, then act on that information through commands or file changes. That means secrets can be exposed both by reading them and by persisting changes that keep access alive. Teams should assume workstation-local state is part of the secret attack surface.
Q: How do security teams know whether agent guardrails are working?
A: They know guardrails are working when denied tool calls are visible in logs, high-risk paths are blocked consistently, and the agent cannot override policy from inside its own session. Observe mode is useful first because it shows what the agent actually tries to do before the team decides where to deny access. The signal is repeatable enforcement, not model compliance.
Q: Should organisations treat agent-installed tools differently from ordinary developer commands?
A: Yes, because an agent can combine discovery, inspection, download, and execution in one flow, which means the attack surface spans both reasoning and runtime. Organisations should treat these installs as higher-risk supply-chain events and require containment, integrity verification, and secret isolation before execution.
Technical breakdown
Why curl | bash breaks artifact integrity
The core weakness is that curl | bash performs a fresh network fetch at execution time, so the shell does not necessarily receive the same bytes the agent previously inspected. That is a TOCTOU condition: the safety decision is made on one artifact, then applied to another. In agentic workflows, that gap is especially dangerous because the agent may treat its own inspection as a trustworthy gate while the actual command still depends on remote content that can change between requests. Practical implication: bind execution to a local, hashed copy of the exact inspected script.
Practical implication: require local execution of the inspected artifact rather than re-downloading content at run time.
How malicious install scripts exfiltrate developer secrets
A malicious installation script does not need complex exploitation if the agent already has access to shell and environment context. Once executed, the script can read environment variables, repository tokens, API keys, and cloud credentials that are present in the developer workspace. The article’s proof of concept shows that even when the model redacts secrets in chat, shell execution can still access the raw values. Practical implication: separate model-facing safety checks from the runtime environment granted to executed commands.
Practical implication: isolate shell execution from sensitive environment variables whenever an agent can install or run third-party code.
Why inspection-only guardrails are brittle in AI coding agents
Inspection-only guardrails assume the reviewed code path and the execution path are the same, but agentic tool use often splits those steps across search, analysis, download, and run actions. That makes the control boundary fragile unless artifact identity is preserved through hashing, checksum validation, or single-download execution. The issue is architectural, not just procedural. Practical implication: enforce policies at execution time, not only during reasoning or preflight review.
Practical implication: enforce the guardrail again at execution time so model approval alone cannot authorize unverified code.
Threat narrative
Attacker objective: The attacker wants to turn a trusted installation flow into a secret-stealing execution path inside a developer environment.
- Entry occurs when a user instructs the agent to install software from a remote host, or when a compromised repository or documentation page embeds the install path.
- Credential access happens when the malicious script runs with shell access and reads environment variables, GitHub tokens, API keys, and other workspace secrets.
- Impact follows when the script exfiltrates those secrets to a remote endpoint while the agent believes it is still executing the inspected artifact.
Breaches seen in the wild
- EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.
- New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
TOCTOU has become an agent governance problem, not just an application security pattern. When an AI coding agent inspects one script and executes another, the control is failing at artifact binding, not at content review. That means traditional pre-execution checks are insufficient when the runtime can fetch fresh network content. Practitioners should treat execution identity and artifact identity as the same governance question.
Agentic developer workflows expand the NHI blast radius because shells inherit sensitive machine credentials. The article shows that environment variables, tokens, and internal repository access can be reachable from agent-executed commands even when the model itself refuses to reveal them. This is a classic machine-identity exposure problem: the agent is acting through credentials that were never meant to be broadly executable. Practitioners should narrow what an agent can inherit at runtime.
Script inspection without checksum enforcement creates a trust gap that attackers can reliably target. A malicious server only needs to vary responses between fetches to defeat an approval decision based on the first copy. This is the same failure mode that makes separate analysis and execution dangerous across software supply chains. Artifact drift: the reviewed payload and the executed payload diverge, so governance must prove sameness, not just safety. Practitioners should require integrity checks before any execution boundary.
AI coding agent security now depends on runtime containment, not just model judgment. The article demonstrates that stronger models may notice risk but still lose control if execution reopens the network trust boundary. That shifts the category toward enforceable controls such as local execution, least-privilege environments, and explicit secret isolation. Practitioners should assume the model can be right and the system can still be unsafe.
From our research library:
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
Artifact drift: AI coding agent security fails when inspection and execution are separated by a fresh network request, because the agent cannot prove that the reviewed script is the script that runs. That shifts the control point from approval to integrity enforcement, and it makes execution containment a governance requirement rather than an implementation detail.
Developer environments are especially sensitive because they often hold credentials that an agent can reach through shell execution. The relevant question is no longer whether the model will reveal a secret in chat, but whether the runtime can expose one to code that was never meant to see it, according to the State of Secrets Sprawl 2026
For practitioners
- Enforce local execution of inspected scripts Download installation scripts once, verify them, and run the local file instead of piping a fresh network response into bash.
- Block curl | bash in agent workflows Treat network-to-shell piping as a prohibited pattern for AI coding agents because it breaks the chain between inspection and execution.
- Remove workspace secrets from agent shells Prevent executed agent commands from inheriting environment variables, cloud credentials, and repository tokens unless a task explicitly requires them.
- Require integrity checks before execution Use hashes or checksum validation to confirm that the artifact approved during inspection is identical to the artifact executed by the agent.
Key takeaways
- The weakness is a trust boundary problem between analysis and execution, not simply a bad script.
- AI coding agents can turn ordinary installation flows into secret exposure events when runtime access is too broad.
- The control that matters is artifact binding, execution containment, and secret isolation at run time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The attack exposes environment secrets and tokens through agent execution. |
| NHI-04 — Insecure Authentication | The agent’s trust in a fresh network fetch weakens the authenticity of the executed artifact. | |
| NHI-07 — Long-Lived Secrets | Persistent workspace credentials create the exposure once malicious code runs. | |
| Recommendation — Scan agent execution paths for secret leakage and block shell access to sensitive environment variables. Require the exact authenticated artifact to be the one executed by the agent. Reduce long-lived secrets available to agent-run commands and scope credentials to the task. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The article describes secret theft followed by outbound exfiltration from the shell. |
| Recommendation — Map agent-executed script abuse to credential access and exfiltration detections. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The issue depends on exposure of workspace authenticators and tokens. |
| Recommendation — Apply authenticator management controls to limit, rotate, and isolate credentials used in agent workflows. | ||
Key terms
- Time-of-check/time-of-use (TOCTOU): A TOCTOU flaw happens when a system verifies one thing and later acts on a different version of it. In agentic workflows, that means a script, package, or binary can look safe during inspection but be altered before execution, breaking the trust chain.
- Account Binding: Account binding is the process of linking an external authenticated identity to the correct local user record. In commerce environments, weak binding creates duplicates, orphaned users, or incorrect updates, so the binding rule is a core governance control, not an implementation detail.
- Session Containment: A control pattern that limits what a single AI agent session can access, retain, or carry forward. It reduces persistence, shared state, and cross-session leakage so that one manipulated interaction does not become an environment-wide security incident.
- Secret Isolation: A design pattern that keeps secrets out of prompts, model memory, and tool payloads while preserving controlled execution. It reduces exposure, but only works when the execution layer independently enforces permissions and logs every action.
Deepen your knowledge
NHI Mgmt Group's NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It is built for practitioners who need to govern machine credentials, runtime trust, and access boundaries across modern development and cloud environments.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org