This 'critical' Cursor security flaw could expose your code to malware - how to fix it

Follow ZDNET: Add us as a preferred source on Google. A new report has uncovered what it describes as "a critical security vulnerability" in Cursor, the popular AI-powered code-editing platform. The report, published Wednesday by software company Oasis Security, found that code repositories within Cursor that contain the .vscode/tasks.json configuration can be instructed to automatically run certain functions as soon as the repositories are opened. Hackers could exploit that autorun feature via malware embedded into the code. Also: I did 24 days of coding in 12 hours with a $20 AI tool - but there's one big pitfall "This has the potential to leak sensitive credentials, modify files, or serve as a vector for broader system compromise, placing Cursor users at significant risk from supply chain attacks," Oasis wrote. While Cursor and other AI-powered coding tools like Claude Code and Windsurf have become popular among software developers, the technology is still fraught with bugs. Replit, another AI coding assistant that debuted its newest agent earlier this week, recently deleted a company's entire database. According to Oasis' report, the problem is rooted in the fact that Cursor's "Workplace Trust" feature is disabled by default. Basically, this feature is intended to be a verification step for Cursor users so that they only run code that they know and trust. Without it, the platform will automatically run code that's in a repository, leaving the window open for bad actors to...