Cursor’s security gaps: what enterprise teams need to harden first

TL;DR: Repello AI documents 11+ Cursor CVEs and named vulnerabilities across 2025 and 2026, spanning sandbox escape, indirect prompt injection into file writes, MCP trust bypasses, and supply-chain exposure through OpenVSX and Chromium lag. The record shows that enterprise deployment depends on version pinning, MCP governance, and auditability that reconstructs agent activity, not just tenant admin events.

Editorial analysis by NHI Mgmt Group, based on content published by Repello AI: “Cursor Security: The 2026 Enterprise Hardening Guide”.

By the numbers:

• Cursor crossed one million daily active developers in 2025 and has continued to grow through 2026.

Key questions

Q: What breaks when a workstation agent can write to trusted config files?

A: The trust model breaks because a file that was approved as benign can later become an execution path.

Q: Why do workstation agents create audit and accountability gaps for IAM teams?

A: Because the platform often logs admin actions but not the underlying AI actions that produced them.

Practitioner guidance

• Pin the fleet to a known-safe Cursor version Force-update to Cursor 2.5 or later through MDM so the known sandbox-escape and MCP classes are removed from the estate.
• Disable project-local MCP trust by default Block or auto-deny changes to project-scoped MCP configuration and route any approved MCP use through centrally managed allowlists.
• Force Workspace Trust and lock extension sources Require Workspace Trust, allowlist OpenVSX publishers, and reject unpinned recommended extensions so the agent cannot inherit trust from a mutable namespace.

Bottom line: Cursor’s CVE history shows that workstation agents can fail through trust decisions, config writes, and upstream dependencies, not only through the model itself.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →