DuneSlide: When a Single Prompt Owns Your Machine
The Cursor IDE vulnerability known as DuneSlide is a pair of prompt injection RCE flaws that let a single, ordinary-looking AI query escape the editor’s sandbox and execute arbitrary system commands on a developer’s machine without any clicks, confirmations, or visible warnings, turning routine use of an AI code editor into a potential zero-click exploit path. This is not an abstract “LLM jailbreak” problem; it is a concrete remote code execution risk in a widely deployed tool. Cato AI Labs disclosed two bugs in Cursor IDE, tracked as CVE-2026-50548 and CVE-2026-50549, both rated 9.8 out of 10 on the CVSS scale. Every version prior to Cursor 3.0 is affected, and more than half the Fortune 500 reportedly use this editor, which makes the blast radius unusually large for what begins as a poisoned prompt. The uncomfortable truth: if your development workflow relies on an AI agent that reads untrusted content, you are already exposing a high-value endpoint.
How Prompt Injection Turns Sandbox Safety into Illusion
Cursor’s answer to earlier prompt-based attacks was to run AI-issued terminal commands inside a sandbox, confining them to a controlled environment in the 2.x line so they could not harm the wider system. DuneSlide exists to break that box. The entry point is prompt injection: attackers hide instructions in something the AI agent reads on the user’s behalf, such as a Model Context Protocol (MCP) service or a web page. The user asks a normal coding question, but hidden instructions ride along and trigger command execution without any explicit approval, making this a true zero-click exploit. These vulnerabilities show that prompt injection RCE is not limited to manipulating model output; it reaches into “classical” code paths like file writes and process launches that many teams still do not consider part of the AI attack surface. Treating AI inputs as benign helper text is no longer defensible—every content source must be viewed as a potential command channel.
Two CVEs, One Goal: Kill the Sandbox and Own the Agent
Both DuneSlide bugs rely on the same core idea: convince the AI agent to write one file it should never touch, then use that write to switch off sandbox protections. In CVE-2026-50548, the agent abuses the working_directory parameter of the run_terminal_cmd tool. Cursor adds any specified path to its allowed-write list without question; injected instructions point it at a system file instead of a project path and overwrite the cursorsandbox helper binary or shell startup files like ~/.zshrc. CVE-2026-50549 takes a different route, abusing a symlink safety check. Cursor resolves shortcuts to confirm writes stay inside the project, but when resolution fails—because the target does not exist or read access is removed—it trusts the shortcut’s in-project appearance and writes through it to external locations. In both cases, once the sandbox helper is replaced, subsequent commands run unsandboxed as the user, compromising the local machine and any connected cloud or SaaS workspaces the editor is signed into.
Patch Status, Zero Known Exploits, and What to Do Today
The good news is that the fix exists; the bad news is that many developers have not treated this as urgent. Both vulnerabilities are patched in Cursor 3.0, released on April 2, and every version before 3.0 is vulnerable. Cato AI Labs reported the issues on February 19, saw them initially dismissed as out-of-scope misuse of MCP servers, then escalated; Cursor reopened the reports and shipped the fixes in 3.0, with CVE IDs assigned on June 5. There is currently no evidence of real-world attacks or known exploitation in the public record. That absence of exploitation is not a safety net; it is borrowed time. If you run Cursor IDE and have not upgraded, you should move to version 3.0 immediately and review any custom MCP integrations or untrusted data sources your agent consumes. Disable or isolate those inputs until you are certain they cannot be abused as hidden instruction channels. Leaving older versions in place on build servers or laptops is equivalent to leaving RCE exposed on your core developer infrastructure.
AI Code Editor Security: Stop Patching Symptoms, Start Fixing Design
DuneSlide is only the latest chapter in a pattern of AI code editor security failures: prior Cursor bugs such as CurXecute, MCPoison, and the booby-trapped Git hook vulnerability all began with poisoned prompts and ended in command execution, each bypassing a different line of defense. The sandbox in the 2.x line was meant to be a structural answer to those issues; DuneSlide is about escaping the answer itself. Cato AI Labs is now disclosing similar flaws in other coding agents and argues this is a structural problem, not a string of isolated mishaps. Any agent that reads the open web or untrusted services must assume that every piece of content is hostile until proven harmless. The real decision facing AI tool vendors is whether they will redesign their systems around that assumption or continue a patch-by-patch scramble as attackers discover new command paths. If your AI development stack does not have a clear threat model for prompt injection RCE and zero-click exploits, you are not “using AI” safely—you are shipping an exposed automation engine with production access.
