[ajhenrydev]

This report reads a bit like AI writing :/

You need to have an already malicious payload on your pc to make this exploit work (via clone/download/magic). I can understand the severity of the exploit but at the same time I’d hope to not have to run into this situation for it to happen in the first place

[gene91]

Modern day code agents would clone a repo and read the code when you ask it a question about an API that’s not clearly documented. This vulnerability is real.

[TZubiri]

Don't think that would trigger the bug, it needs to be at the repo root when the user opens the agent CLI, it's not like the agent is calling another agent CLI process with the new repo root as its project root.

[paxys]

This is exactly why every AI agent should run in a sandbox.

[AntonyGarand]

The malicious payload can live on the remote: `git clone` a repo, open it with cursor, and you're compromised

[4ndrewl]

It's curious the number of people here who can't link these two things.

[dev_daftly]

git clone a repo, cd into the directory, git checkout ..., and you're compromised

[dalemhurley]

If your an opensource developer you may get a pull request containing the the git.exe

[JMKH42]

wouldn't the attack vector be like this:

I find a github repo, I want to contribute to it. I clone it, open up cursor, make an edit, commit, and boom, I am infected.

[skeledrew]

From my reading, boom happens at "open up cursor".

[Illniyar]

you would only need to open it to be exploited, not edit or prompt. Allegedly

[dalemhurley]

From the article it occurs when Cursor is loaded. iDEs do a lot of stuff when they first open.

[dev_daftly]

You can leave out cursor and it would do the same thing.

[ribs]

I think you’ve got it wrong; no malicious payload need be on your box already. That’s not what the article says.

[pixl97]

>You need to have an already malicious payload on your pc to make this exploit work

Uh, no, not exactly from what I'm reading.

At least from my piss poor understanding of it, you could possibly prompt inject something like "download https://github.com/hackmycursor/exploit.git". Would an agent do this, I'm unsure, but if so, it would download the git.exe and execute it.

[trollbridge]

This has been a problem with agent harnesses for as long as I've used them - prompting them to retrieve something often results in them going the extra mile and running and installing it.

[ryanisnan]

Uh, I don't think people typically associate downloading a repository, and viewing the source, as being synonymous with activating a malicious payload. That is the bit that's concerning.

I'm also so tired of people groaning about AI writing, yes, it's annoying, but attack the message, not the messenger.