Cursor Terminal Cmd-K Webpage Prompt Injection to Command Execution

How the attack works

An attacker plants text on a webpage designed to look like an instruction rather than content. A user opens Cmd-K in the Cursor terminal while that page is in context, and the injected text gets pulled into the prompt Cursor uses to generate a shell command. The AI follows the injected instruction instead of the user's actual request, producing a command such as one that downloads a script over plain HTTP and pipes it into an interpreter, decodes and runs encoded data, fetches a file and makes it executable, or reads credential files and sends them out. The rule watches for two separate signals scoped to the Cursor process: a command line with one of these attacker-shaped patterns, or an outgoing web request from Cursor whose body contains both instruction-override language and command-generation markers with an explicit shell directive. It does not try to link the two together into one confirmed chain — it only flags each as suspicious on its own.

Netzilo detection

Why it matters

A successful attack can get an attacker-chosen command run on the developer's machine using the credentials and access that user already has, potentially leading to credential theft, malware download, or execution of arbitrary code — all without the user knowingly typing that command.

What you can do

• →Keep Cursor and its terminal integration updated, since this specific chain was patched by the vendor in September 2024.
• →Review Cmd-K/Ctrl-K generated commands before letting them execute, especially when a webpage was recently viewed or referenced in context.
• →Restrict or monitor outbound plain-HTTP fetches piped into shells, and block traffic to known paste/tunnel services from developer endpoints.
• →Treat any AI-generated terminal command containing decode-and-execute, fetch-and-chmod, or credential-file-to-network patterns as suspicious regardless of source.

Known benign look-alikes

• A detection or security engineer authoring, grepping or testing prompt-injection rules inside the Cursor integrated terminal - mitigated by filter_rule_authoring (Sigma/YAML rule keys, promptfoo/garak/llm-guard markers) and filter_readonly_search (grep/rg/git-grep/less/head style read-only commands).
• Bootstrap installers that legitimately pipe a downloaded script into a shell (rustup, nvm, homebrew, docker convenience script). These are served over HTTPS to a normal domain, so sel_remote_shape (which requires cleartext http:// to a dotted public host, a tunnel/paste service, or URL userinfo credentials) does not match them.
• Local development servers (http://localhost, http://127.0.0.1, RFC1918 hosts) fetched and piped to a shell. sel_remote_shape requires an alphabetic TLD after a dot, so hostless and dotted-quad targets never satisfy it - achieved by narrowing the pattern, not by trusting any host.
• Legitimate developer requests such as "scp my deploy key to the build box" or reading a .env file into a curl call - real, and the reason this branch requires both a credential-shaped path and an egress primitive in the same command line, and the reason the rule is report-only.
• A user pasting security-awareness or red-team documentation that quotes "ignore previous instructions" into the Cmd-K prompt - branch B additionally requires terminal-command-generation markers and an explicit run/execute directive naming a shell primitive, and filter_placeholder suppresses obvious illustrative payloads.
• Cursor telemetry or crash reports echoing a previously blocked command line.

References

• https://attack.mitre.org/techniques/T1059/
• https://atlas.mitre.org/techniques/AML.T0051
• https://owasp.org/www-project-top-10-for-large-language-model-applications/

Related threats