Topic starter
06/11/2026 6:36 pm
TL;DR: Cursor security incidents show 10 documented attacks between August 2025 and October 2026, including three in the wild and four causing confirmed harm without a CVE, according to Adversa AI research. The gap between published vulnerabilities and real-world damage means workspace trust, extension governance and runtime controls matter more than CVE counts.
Editorial analysis by NHI Mgmt Group, based on content published by Adversa AI: “Cursor security Top 10 attacks and what each one actually broke”.
By the numbers:
- Adversa AI says 10 documented attacks on Cursor occurred between August 2025 and October 2026.
- Adversa AI says the trojanized Claude Code extension was served for about 11 hours on October 29, 2026.
- Adversa AI says the Agentjacking research reported an 85% success rate across Claude Code, Cursor and Codex.
Key questions
Q: How should teams govern third-party extensions in AI-enabled developer environments?
A: Use the same discipline applied to other third-party access paths: inventory what is installed, restrict what each component can do, review updates before rollout, and revoke anything that expands scope without a clear business need.
Q: Why do coding agents amplify workspace security risks?
A: Coding agents amplify workspace security risks because they can read files, follow instructions buried in content, and act on that content with tool or shell access across the control boundary between untrusted workspace data and privileged execution.
Q: What should teams do first when a coding agent can run commands from workspace content?
A: Teams should first separate untrusted workspace content from execution paths, then require a review from execution before any command runs.
Practitioner guidance
- Turn on workspace trust across managed devices Disable automatic trust for unvetted repositories so folder-open behaviour cannot trigger tasks or helper processes before review.
- Govern extensions as software supply chain assets Inventory installed extensions, pin versions, restrict marketplace installs and treat signed publisher names as insufficient proof of safety.
- Block agent actions until runtime policy approves them Place a policy layer between agent instruction and command execution so destructive file operations, persistence steps and network calls can be stopped before they run.
Bottom line: Cursor incidents show that harmful behaviour often enters through trusted workspace channels rather than through a classic product vulnerability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Trust boundaries around coding agents are now the real control surface: The decisive failure is not just a vulnerable binary, but the assumption that marketplace content, repository files and MCP output can be safely interpreted inside the agent runtime. That assumption breaks when attacker-controlled text is allowed to become instruction. Governance has to move from patch-only thinking to boundary control over what the agent may consume and execute.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How do you reduce the blast radius of a compromised developer token?
A: Reduce the blast radius by issuing the developer token with the narrowest possible scope, short expiry, audience restriction, and environment binding. Prefer per-service or per-workload tokens over shared developer tokens, and revoke or rotate immediately after exposure. Map token ownership to a named person or team so access can be removed fast.
👉 Read our full editorial: Cursor attacks expose the gap between CVEs and real damage