Hackers Exploit Rogue MCP Server to Inject Malicious Code into Cursor’s Built-In Browser

Security researchers have uncovered a critical vulnerability in Cursor, the AI-powered code editor, that lets attackers inject malicious code via rogue MCP servers. Unlike VS Code, Cursor lacks integrity checks on its runtime components, making it vulnerable to tampering through MCP server registration.

The attack works by registering a local MCP server that entirely bypasses Cursor’s built-in security controls; when a developer enables a malicious MCP server and restarts Cursor, the embedded browser becomes compromised. Attackers can inject arbitrary JavaScript to hijack the internal browser, replacing legitimate login pages with credential-harvesting fakes that send stolen credentials to remote servers.

The process involves enabling the MCP server, restarting Cursor to apply changes, and running the malicious JavaScript, a dual-layer eval approach that broadens the attacker’s capabilities. The disclosure highlights broader risks from AI-enabled development tools and underscores the need for thorough review of MCP servers and extensions before use.