Vibe coding tool Cursor’s MCP implementation allows persistent code execution

More evidence that AI expands the attack surface

Check Point researchers uncovered a remote code execution bug in popular vibe-coding AI tool Cursor that could allow an attacker to poison developer environments by secretly modifying a previously approved Model Context Protocol (MCP) configuration, silently swapping it for a malicious command without any user prompt.…

This article has been indexed from The Register – Security

Read the original article: