Cursor JSON Schema Download Exfiltration

How the attack works

An attacker first achieves prompt injection against the Cursor Agent, getting it to follow attacker-supplied instructions. The agent is directed to create or edit a JSON file with a '$schema' key pointing to a URL the attacker controls. Before writing the URL, the agent is made to embed data it can access — environment variables, API keys, file contents — into the query string, path, or hostname. The moment the file is saved, the editor automatically issues an unattended GET request to that URL, sending the embedded data to the attacker's server disguised as a normal schema download.

Netzilo detection

Why it matters

An organization can lose credentials, environment variables, or file contents through what looks like ordinary editor traffic, with no user click or approval required to trigger the leak.

What you can do

• →Disable automatic JSON schema fetching in your editor settings if the feature is not needed (in VS Code-derived editors this is often controlled by a schema-download setting).
• →Restrict or proxy outbound network access from developer machines and CI agents so arbitrary external hosts cannot be reached from the editor process.
• →Review any AI coding agent's outputs before applying them, especially newly created or modified JSON files with unfamiliar '$schema' values.
• →Monitor outbound requests for JSON-schema-shaped URLs that carry long opaque parameters, base64 segments, encoded JSON, or credential-like strings, since a legitimate schema fetch never needs a payload.

Known benign look-alikes

• Agent fetching an authenticated JSON API endpoint that ends in .json and passes a JWT or opaque session token in the query string (for example a Firebase realtime-database read, or a legacy API using ?access_token=eyJ...). The URL still has to end in .json or contain a "schema" path component for this to fire, so ordinary REST paths do not match.
• Presigned object-storage downloads of a .json artifact. The two most common forms (AWS SigV4, GCS V4, GCS V2, Azure SAS) are explicitly suppressed by filter_presigned; an unusual signing scheme with a >=120 character opaque parameter could still report.
• Schema or config downloads from a CDN that append a very long cache-busting or build fingerprint parameter (>=120 characters). Typical fingerprints are 8-40 characters and do not reach the threshold.
• Security research, CTF or detection-engineering traffic that deliberately places sample credential strings in a URL. Obvious placeholder and template tokens are suppressed by filter_placeholder.
• Very long single-label hostnames used by some ephemeral preview or tunnel providers can match the subdomain-smuggling pattern when the fetched path is a .json file.

References

• https://atlas.mitre.org/techniques/AML.T0051
• https://attack.mitre.org/techniques/T1567/
• https://attack.mitre.org/techniques/T1041/

Related threats