DuneSlide: When a Single Prompt Owns Your Machine
DuneSlide is a pair of critical Cursor IDE vulnerabilities that allow hidden prompt injection to escape the AI agent’s sandbox, disable its protections, and trigger remote code execution through zero‑click command execution on a developer’s machine. This is not another harmless LLM jailbreak story; it is a direct line from “ordinary‑looking prompt” to full system compromise. Two flaws in Cursor, an AI code editor, could let a single, ordinary‑looking prompt break out of the editor's safety sandbox and run any command on a developer's computer. Both issues—CVE-2026-50548 and CVE-2026-50549—are rated 9.8 on the CVSS scale, underscoring that prompt injection RCE is now a first-class software vulnerability, not an academic curiosity. If you treat AI IDE security as optional, DuneSlide is your wake-up call.
How Zero-Click Prompt Injection Breaks Cursor’s Sandbox
The attack vector is deceptively simple: exploit how Cursor’s AI agent interprets hidden instructions embedded in content it reads, then abuse file writes to shut off the sandbox. The attacker never types into your Cursor; they plant instructions inside a connected service via the Model Context Protocol or in a web page result. You ask a normal question, the hidden instructions come along for the ride, and because it needs no click or approval from you, the attack is zero‑click. Starting in the 2.x line, Cursor runs agent-issued terminal commands inside a sandbox to limit damage from bad instructions. DuneSlide targets that defense: both flaws use the same trick—get the agent to write one file it should not be allowed to write, then use that write to turn the sandbox off. Once neutralized, the next command runs as you, with access to the local machine and connected SaaS workspaces.
CVE-2026-50548 and CVE-2026-50549: Same Outcome, Different Doors
CVE-2026-50548 abuses Cursor’s working_directory setting on its run_terminal_cmd tool. The sandbox allows writes inside a command’s working folder; when the agent sets a non-default path, Cursor blindly adds that path to the allowed-write list. Prompt-injected instructions can redirect this to a system file—such as the cursorsandbox helper binary on macOS—so the agent overwrites the very component that enforces sandboxing. Startup files like ~/.zshrc are also viable targets. CVE-2026-50549 abuses a safety check around symlinks. Cursor attempts to resolve shortcuts to confirm they point inside the project, but when the check fails—because the target does not exist or read access is removed—it trusts the apparent in-project path instead. An attacker creates a shortcut that secretly points outside the project, forces the check to fail, and Cursor writes straight through it to the same helper. Different bugs, same end: sandbox off, prompt injection RCE on.
Patch Status, Upgrade Guidance, and Why Cursor 3.0 Is Non-Negotiable
Here is the one pragmatic takeaway: if you use Cursor IDE on any developer workstation, upgrade to Cursor 3.0 immediately. Both bugs are patched in Cursor 3.0, released April 2, and every version before 3.0 is affected. Cursor’s maker says more than half the Fortune 500 use the tool, so if you run it, update now. Exploitation lets a threat actor overwrite critical system files like the cursorsandbox binary, converting supposedly safe sandboxed commands into fully unsandboxed remote code execution and compromising both the local machine and connected SaaS workspaces. Cato AI Labs reported the issues on February 19; after an initial rejection, Cursor reopened, triaged, and shipped fixes in 3.0, with CVE IDs assigned June 5. There is no sign these have been used in real attacks; they are disclosed as research rather than active exploitation. That window of “no known exploitation” only stays open if teams patch before attackers start testing old builds.
AI IDE Security: Treat Every Input as Hostile, or Keep Scrambling
DuneSlide proves that prompt injection is more than tricking an LLM into saying odd things; it reaches deep into classic code paths that were never considered part of the attack surface. It is the latest in a run of Cursor IDE vulnerabilities where a poisoned prompt ends in code execution, each one defeating a different guardrail. Earlier bugs abused MCP configuration, Slack messages, and Git hooks; the sandbox in the 2.x line was Cursor’s answer, and DuneSlide is about escaping that answer. Cato AI Labs argue that similar flaws exist in other coding agents and that the problem is structural, not a handful of mistakes. The uncomfortable question for everyone shipping an AI-powered IDE is whether treating every input—from MCP services to web pages—as hostile becomes the default, or whether we continue a patch‑by‑patch scramble. Ignoring prompt injection RCE now is not cautious; it is negligent. AI IDE security must be designed as carefully as any other execution engine.
