Malicious Attackers Can Take Over Dev Environments with Just Two Clicks, Raising Alarms in the AI Coding Community
A disturbing vulnerability has been uncovered in one of the most widely used artificial intelligence (AI) coding tools, Cursor AI. Researchers at Adversa AI have revealed that attackers can install permission-rich model context protocol (MCP) servers on privileged developers’ machines with just two clicks, raising concerns about the potential for source code theft and malicious activity.
Cursor AI is a popular choice among developers, used by over 50,000 enterprises, including 64% of the Fortune 500. Its valuation has skyrocketed in recent months due to strong revenue numbers and an acquisition by SpaceX. However, this vulnerability highlights the risk of relying on AI coding tools that are not adequately secured.
The exploit works by concealing malware in a fake Git file, which is then presented as a legitimate pull request. Developers who click on the link will be prompted to install an MCP server, which can execute arbitrary commands with the same privileges as the user. This allows attackers to steal source code, secrets, or even infect the developer’s employer.
The researchers used double URL encoding to turn their MCP install deeplink into a blob of text embedded inside a pull request link, making it nearly impossible for developers to suspect anything was amiss. The attack is reminiscent of argument injection flaws seen in software development for years, and AI platforms have been recreating this vulnerability one after another.
“It’s a general, old class, not specific to AI tools,” says Rony Utevsky, lead researcher at Adversa AI. “AI platforms have been recreating it one after the other. We’ve seen similar vulnerabilities in Claude Code and Codex, and now we’re seeing it in Cursor.”
While developers may be able to avoid the infection by quitting out of the dialog box, there are two good reasons they might not: a lack of awareness about the potential threat or a sense of trust in the tool they are using. This is where the problem lies – relying on AI tools that have not been adequately secured.
The fact that this vulnerability was uncovered highlights the need for developers to be vigilant when working with AI coding tools. It’s essential to understand the risks involved and take steps to mitigate them, such as regularly updating software, being cautious of unexpected prompts or links, and verifying the authenticity of any requests before clicking on them.
Ultimately, this vulnerability serves as a reminder that even the most widely used tools can have hidden vulnerabilities. As the AI coding community continues to grow, it’s essential to prioritize security and take proactive steps to prevent such attacks from occurring in the future.
Source: Dark Reading — 2026-07-15