**Malicious AI Coding Tool Exploit Takes Over Dev Environments with Just Two Clicks**
A significant security vulnerability has been discovered in a popular artificial intelligence (AI) coding tool, allowing attackers to install malware on developers’ machines and gain access to sensitive code and secrets. The exploit, which can be triggered with just two clicks, exploits weaknesses in the way developers interact with AI tools, highlighting the growing risks of cybersecurity threats in the coding world.
The vulnerability affects Cursor AI, a widely used AI code editor that has been adopted by over 50,000 enterprises, including 64% of the Fortune 500. Researchers at Adversa AI have revealed two old-fashioned vulnerabilities that combine to allow an attacker to install malware on a victim developer’s machine in the form of a malicious Model Context Protocol (MCP) server.
MCP servers are powerful tools for connecting AI models to external tools and services, but they can also be used as “supercharged backdoors” when exploited maliciously. When installed with elevated privileges, an MCP server can execute arbitrary commands on a developer’s machine, allowing attackers to steal sensitive code or secrets, or even infect the developer’s employer.
The exploit works by concealing malware in a fake Git file, which is then triggered when the victim developer clicks on a seemingly innocuous link. The researchers used double URL encoding to turn the malicious link into a blob of text embedded inside a pull request link, making it more likely that a developer would click on it without suspecting anything.
Rony Utevsky, lead researcher at Adversa AI, notes that this vulnerability is not specific to AI tools and has been seen in other software platforms for years. “It’s a general, old class of vulnerability,” he says, “and AI platforms have been recreating it one after the other.”
While the exploit can be triggered with just two clicks, there are some safeguards in place that might prevent the attack from succeeding. When the victim developer clicks on the link, a dialog box will pop up inside their IDE, asking if they want to install an MCP server. An attentive developer might notice something is awry at this point and quit out of the infection flow.
However, there are two good reasons why a developer might not be so lucky: firstly, the dialog box may not be particularly noticeable in a fast-paced development environment; secondly, developers often trust links from colleagues, which can make them more likely to click on a seemingly innocuous link without suspecting anything.
The discovery of this exploit serves as a reminder that cybersecurity threats are becoming increasingly prevalent in the coding world. Developers must remain vigilant and take steps to protect themselves against these types of attacks, such as being cautious when clicking on links from unknown sources and regularly reviewing their IDE settings for suspicious activity.
Ultimately, the vulnerability in Cursor AI highlights the need for greater awareness and vigilance among developers, as well as a greater emphasis on security in AI coding tools. By taking proactive steps to secure our development environments, we can prevent these types of attacks from succeeding and keep our code and secrets safe from harm.
Source: Dark Reading — 2026-07-15