Cursor's DuneSlide RCE: when your AI agent runs the terminal

Give an AI coding agent a terminal and the convenience is obvious: it runs the build, installs the package, greps the logs — no approval clicks. The risk is the same sentence with one word changed. If the agent will run any command it's told to, then anyone who can plant a command in what the agent reads can run code on your machine. That's not hypothetical anymore. Cato AI Labs published DuneSlide on July 1 — two flaws that turn Cursor's auto-run terminal into zero-click remote code execution.

What actually happened

DuneSlide is CVE-2026-50548 and CVE-2026-50549, both rated CVSS 9.8. The setup: Cursor 2.x runs terminal commands inside a sandbox by default, with no user approval — a design meant to kill approval fatigue. The two bugs let an attacker break out of that sandbox. Per The Hacker News, one abuses a non-default working_directory parameter to write outside the project scope; the other uses a symlink whose canonicalization fails, so Cursor falls back to the original path and writes where it shouldn't. Either way, the attacker overwrites the cursorsandbox binary itself — after which every "sandboxed" command runs unsandboxed on the host.

The trigger is prompt injection with no click required. Hidden instructions live in something the agent ingests on its own: a poisoned web search result, a connected MCP server, a file it's asked to read. Cato's write-up is blunt about the payoff — full compromise of the developer's machine "plus any cloud or SaaS workspaces" the editor can reach. The flaws were reported in February and fixed in Cursor 3.0, released April 2; every version before 3.0 is affected. CVE IDs landed June 5, and the public breakdown dropped July 1.

Why it matters for your business

Most small teams don't run Cursor — but "an AI agent with a terminal and no approval step" describes a lot of what shipped in the last year, from coding assistants to the automation tools quietly wired into your ops. DuneSlide is the template: prompt injection is now a remote-code-execution vector, and the exposure scales with how much autonomy you handed the agent and how much it can already touch.

Two things to do. First, the boring one: if anyone on your team or your contractors uses Cursor, confirm they're on 3.0 or later — a version older than April is a live 9.8 sitting on a machine with your repo keys and cloud credentials on it. Second, the durable one: treat auto-run as a setting you decide, not a default you inherit. An agent that executes commands should run with least privilege, read only from sources you trust, and — for anything that touches production or secrets — keep a human in the approval path. Convenience that removes the human is convenient for the attacker too.

Sources: Cato Networks, The Hacker News.