How the attack works
An attacker plants text on a webpage designed to look like an instruction rather than content. A user opens Cmd-K in the Cursor terminal while that page is in context, and the injected text gets pulled into the prompt Cursor uses to generate a shell command. The AI follows the injected instruction instead of the user's actual request, producing a command such as one that downloads a script over plain HTTP and pipes it into an interpreter, decodes and runs encoded data, fetches a file and makes it executable, or reads credential files and sends them out. The rule watches for two separate signals scoped to the Cursor process: a command line with one of these attacker-shaped patterns, or an outgoing web request from Cursor whose body contains both instruction-override language and command-generation markers with an explicit shell directive. It does not try to link the two together into one confirmed chain — it only flags each as suspicious on its own.
Why it matters
A successful attack can get an attacker-chosen command run on the developer's machine using the credentials and access that user already has, potentially leading to credential theft, malware download, or execution of arbitrary code — all without the user knowingly typing that command.
What you can do
- Keep Cursor and its terminal integration updated, since this specific chain was patched by the vendor in September 2024.
- Review Cmd-K/Ctrl-K generated commands before letting them execute, especially when a webpage was recently viewed or referenced in context.
- Restrict or monitor outbound plain-HTTP fetches piped into shells, and block traffic to known paste/tunnel services from developer endpoints.
- Treat any AI-generated terminal command containing decode-and-execute, fetch-and-chmod, or credential-file-to-network patterns as suspicious regardless of source.
Known benign look-alikes
- A detection or security engineer authoring, grepping or testing prompt-injection rules inside the Cursor integrated terminal - mitigated by filter_rule_authoring (Sigma/YAML rule keys, promptfoo/garak/llm-guard markers) and filter_readonly_search (grep/rg/git-grep/less/head style read-only commands).
- Bootstrap installers that legitimately pipe a downloaded script into a shell (rustup, nvm, homebrew, docker convenience script). These are served over HTTPS to a normal domain, so sel_remote_shape (which requires cleartext http:// to a dotted public host, a tunnel/paste service, or URL userinfo credentials) does not match them.
- Local development servers (http://localhost, http://127.0.0.1, RFC1918 hosts) fetched and piped to a shell. sel_remote_shape requires an alphabetic TLD after a dot, so hostless and dotted-quad targets never satisfy it - achieved by narrowing the pattern, not by trusting any host.
- Legitimate developer requests such as "scp my deploy key to the build box" or reading a .env file into a curl call - real, and the reason this branch requires both a credential-shaped path and an egress primitive in the same command line, and the reason the rule is report-only.
- A user pasting security-awareness or red-team documentation that quotes "ignore previous instructions" into the Cmd-K prompt - branch B additionally requires terminal-command-generation markers and an explicit run/execute directive naming a shell primitive, and filter_placeholder suppresses obvious illustrative payloads.
- Cursor telemetry or crash reports echoing a previously blocked command line.