Vibe coding tool Cursor's MCP implementation allows persistent code execution

Check Point researchers uncovered a remote code execution bug in popular vibe-coding AI tool Cursor that could allow an attacker to poison developer environments by secretly modifying a previously approved Model Context Protocol (MCP) configuration, silently swapping it for a malicious command without any user prompt. The good news: Cursor released an update (version 1.3) on July 29 that fixes the issue and requires user approval every time an MCP Server entry is modified. So if you use the AI-powered code editor, update to run the latest version and ensure you're not giving miscreants complete access to your machine every time you open Cursor. While Cursor addressed the flaw, Check Point thinks the vulnerability highlights a major AI supply chain risk. "The flaw exposes a critical weakness in the trust model behind AI-assisted development environments, raising the stakes for teams integrating LLMs and automation into their workflows," the security shop's research team wrote in a Tuesday blog. MCP is an open-source protocol that Anthropic introduced in November 2024 to allow AI-based systems, like agents and large language models (LLMs), to connect to external data sources and interact with each other. While MCP does make those processes easier, it also opens the door to a whole new attack surface and related security threats, which researchers have had fun poking holes in since its rollout. Cursor is an AI integrated development environment (IDE) that uses LLMs to help write...