Cursor Issue Paves Way for Credential-Stealing Attacks

Researchers from cybersecurity vendor Knostic have detailed an attack that uses MCP servers to hijack Cursor’s internal browser, enabling credential-stealing attacks by injecting arbitrary code and delivering a malicious page to harvest logins. The flaw stems from Cursor’s failure to perform integrity checks on features specific to its AI-powered development environment, a gap not shared by environments like Visual Studio Code, according to a recent blog post.

In a proof-of-concept, the researchers replaced Cursor’s login pages with a page that collects credentials and redirects users to a remote attacker, and demonstrated how a victim’s workstation could subsequently be compromised. They achieved this by locating Cursor’s extension within the local extensions directory, overwriting the page body via document.body[.]innerHTML and bypassing UI-level checks, thereby ensuring attacker-controlled content is what the user sees.

The attack exposes a broader risk for the AI-assisted developer ecosystem, with experts cautioning that MCP servers, extensions, and prompts can potentially run code in a user’s environment and, by extension, the corporate network, without user awareness. Cursor emphasised there is no flaw for developers to fix; rather, the research illustrates the inherent insecurity of the environment and the need for careful review of MCPs and extensions.