News
Cursor incidents caused damage without exploiting a published Cursor CVE.
The confirmed damage notably goes through extensions and project files that the agent trusts.
In October 2026, the Cursor marketplace distributed a booby-trapped Claude Code extension for about 11 hours.
At PocketOS, an agent deleted a production volume with a Railway token found in a file.
Workspace Trust is disabled by default, letting a .vscode/tasks.json task run when a folder is opened.