The short answer
On 1 July 2026, Cato AI Labs disclosed two critical remote code execution flaws in the AI code editor Cursor — CVE-2026-50548 and CVE-2026-50549, both rated 9.8 on CVSS 3.1 — where a zero-click prompt injection escapes the editor's command sandbox and runs code on the developer's machine. Both are fixed in Cursor 3.0, released on 2 April 2026; every earlier version is affected. There is no sign of exploitation in the wild. The takeaway for engineering leaders is bigger than one editor: an AI agent that autonomously reads web pages, repository files, and connected tools has turned untrusted content into a code-execution channel.
Cursor says its editor is used inside more than half of the Fortune 500, so the population of exposed developer endpoints is large wherever teams have not yet moved to 3.0. Patch first; then decide how AI coding agents fit into your threat model, because Cato says it is finding the same class of problem across other popular agents too.
What Cato disclosed
Researchers at Cato AI Labs, the research arm of Cato Networks, published a write-up they call DuneSlide: a pair of vulnerabilities that turn Cursor's AI agent into a delivery vehicle for remote code execution. The core idea is that prompt injection does not have to stop at the language-model layer. Fed the right hidden instructions, the agent can be steered into classical file-system operations that were never treated as part of the editor's attack surface — and those operations are enough to neutralise the sandbox that is supposed to contain agent-run commands.
The severity reflects that reach. Both issues are scored 9.8 on CVSS 3.1 (9.3 on the newer CVSS 4.0 scale), and the outcome is full control of the developer's environment. Because a modern editor is typically signed into cloud consoles, package registries, and SaaS tools, a compromised endpoint is rarely contained to one machine — which is why AI-agent risk belongs in the same conversation as the way teams build AI agents and assistants for their own products. The timeline matters for how you triage: Cato reported the flaws privately on 19 February 2026; Cursor initially rejected the report, then reopened and fixed both bugs in the Cursor 3.0 release on 2 April; the CVE identifiers were assigned on 5 June, and the public disclosure landed on 1 July. Importantly, Cato frames this as research, and no exploitation has been seen in the wild.
How the sandbox escape works
Cursor runs agent-issued shell commands inside a sandbox, and the safety of that sandbox depends on a small number of trust assumptions. DuneSlide breaks two of them. In CVE-2026-50548, the sandbox trusts the working directory the agent selects for a command. If injected instructions point that directory at a system path rather than the project, the agent can write where it should not — including over the cursorsandbox binary that enforces the isolation. Overwrite the enforcer, and the next command runs with no sandbox at all, under the developer's own privileges.
CVE-2026-50549 abuses a safety check on symbolic links. Before writing, Cursor tries to resolve a symlink to confirm the real destination sits inside the project. The bug is the fallback: when that resolution fails — because the target does not exist, or an attacker has removed read access on a folder in the path — the editor does not refuse the write. Instead it trusts the apparent in-project path and proceeds, letting a crafted link redirect the write outside the workspace. Either flaw, on its own, is enough to escape.
The delivery mechanism is what makes this a modern problem rather than a routine path-traversal bug. The attacker never touches your keyboard. They plant instructions in something your agent reads on your behalf — a page returned by a web search, a file in a dependency or repository, or the response from a connected Model Context Protocol (MCP) server. The agent, doing exactly what you asked in a benign prompt, follows the buried instructions and carries out the escape. That is why it is described as zero-click: after the first ordinary request, no further human action is required.
The two flaws at a glance
Both are critical, both are fixed in the same release, and both share one root cause — the sandbox trusting a path the agent can be tricked into choosing.
| Detail | CVE-2026-50548 | CVE-2026-50549 |
|---|---|---|
| Type | Working-directory trust → sandbox binary overwrite | Symlink check fallback → out-of-project write |
| CVSS 3.1 | 9.8 Critical | 9.8 Critical |
| Entry vector | Indirect (zero-click) prompt injection via content the agent reads (web, repo, MCP) | |
| Impact | Unsandboxed RCE as the user; reaches connected cloud & SaaS workspaces | |
| Affected | All Cursor versions before 3.0 | |
| Fixed in | Cursor 3.0 (released 2 April 2026) | |
| Exploited? | No known exploitation as of the 1 July 2026 disclosure | |
What it means for US & EU software teams
Strip away the specifics and DuneSlide is a preview of a category, not a one-off. The industry has spent two years wiring autonomous agents into the developer workflow, and those agents read untrusted content — search results, third-party repos, package metadata, tool outputs — as a routine part of their job. Every one of those inputs is now a potential instruction channel. The sandbox was meant to be the backstop; DuneSlide shows the backstop can be dismantled by the same agent it was meant to contain. Defence-in-depth, not a single sandbox, is the design that survives this.
For regulated products the blast radius is the uncomfortable part. A developer endpoint typically holds source code, cloud credentials, and tokens for production SaaS. In FinTech and HealthTech, a single compromised laptop can put customer data paths and deployment keys within reach, which turns an editor CVE into an incident-response and disclosure question. That is why AI-agent risk should be logged in the same register as your other supply-chain and secure-SDLC controls, and why SOC 2 readiness programmes now need to say something specific about how agents are sandboxed, updated, and monitored.
The good news is that the immediate fix here is boring and effective: upgrade. Cursor 3.0 closes both holes, and the highest-risk population is simply teams that have not rolled it out. The harder, more durable work is governance — deciding which MCP servers an agent may connect to, applying least privilege so the editor is not authenticated into production, scoping and rotating the tokens the agent can reach, and putting the developer endpoint under the same monitoring as any other sensitive host.
What to do this week
A short, practical sequence that turns the disclosure into action rather than anxiety:
- Force the upgrade. Confirm every developer is on Cursor 3.0 or later; block or flag older versions through your device management. This closes CVE-2026-50548 and CVE-2026-50549 outright.
- Inventory your MCP connections. List which servers and tools your agents are allowed to read. Untrusted or unnecessary connections are the injection surface — trim them.
- Apply least privilege to the editor. Do not sign the AI editor into production cloud or SaaS accounts. Use scoped, short-lived tokens and separate developer identities from deployment ones.
- Monitor the endpoint. Treat the developer machine as a sensitive host: EDR, egress logging, and alerts on unexpected writes to system paths or new outbound tunnels.
- Fold agents into your SDLC. Add AI coding agents to your threat model, secure-SDLC checklist, and periodic security testing, so the next agent CVE is a known-owner item rather than a scramble.
None of this is a reason to abandon AI coding agents — the productivity case is real, and the fix for DuneSlide is a routine update. But the disclosure is a clear signal: the moment an agent acts autonomously on content you did not write, it belongs inside your security programme, not outside it.
Frequently asked questions
What are the Cursor DuneSlide vulnerabilities?
DuneSlide is Cato AI Labs' name for two critical RCE flaws in the AI code editor Cursor — CVE-2026-50548 and CVE-2026-50549, both scored 9.8 on CVSS 3.1. Each lets indirect prompt injection break out of Cursor's command sandbox and run code on the developer's machine, with no user action beyond an initial benign prompt.
Are the Cursor flaws being actively exploited?
No. As of the 1 July 2026 disclosure there is no evidence of exploitation in the wild; Cato presented DuneSlide as research. The practical risk is concentrated in teams still running Cursor versions earlier than 3.0.
Which Cursor version fixes it?
Both flaws are fixed in Cursor 3.0, released on 2 April 2026. Every earlier version is affected. Cato reported the issues on 19 February, the CVE IDs were assigned on 5 June, and disclosure followed on 1 July. Make sure every developer is on 3.0 or later.
How does prompt injection lead to remote code execution?
The agent reads untrusted content on your behalf — a web page, a repo file, or output from a connected MCP tool — and an attacker hides instructions inside it. Those instructions steer the agent to write outside the project and overwrite the binary that enforces the sandbox, so the next command runs unsandboxed with your privileges.
What should teams using AI coding agents do?
Upgrade Cursor to 3.0 or later, then govern the agent: restrict which MCP servers it can read, apply least privilege so it is not signed into production, scope and rotate reachable tokens, and monitor the developer endpoint. Add AI agents to your secure SDLC and periodic security testing rather than trusting the sandbox alone.
Sources
Cato Networks — DuneSlide: Two Critical RCE Vulnerabilities via Zero-Click Prompt Injection in Cursor IDE, 1 July 2026 (primary source)
CSO Online — Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector, 1 July 2026
The Hacker News — Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands, July 2026