Cursor Agent Workspace Escape - File Write Outside Project Root

How the attack works

An attacker feeds the coding agent context (for example through a malicious file, dependency, or instructions embedded in a repo) designed to make it believe an out-of-scope write is legitimate. The agent's write-permission check, broken in Cursor versions 0.45.0 through 0.48.6, fails to block the request. The agent then runs a command - a shell redirect, tee, PowerShell Out-File, or an inline file-write call - whose target path escapes the project directory using multiple '../' segments or points straight at a home-directory or system path such as ~/.ssh, a shell profile, or /etc. The result is a file write the user never approved, landing outside the folder they trusted the agent with.

Netzilo detection

Why it matters

An attacker who controls the content an AI agent reads can get it to overwrite credentials, SSH configs, shell startup files, or system locations, potentially achieving persistence or credential theft with no user awareness that anything left the project folder.

What you can do

• →Upgrade Cursor past the affected 0.45.0-0.48.6 range if still on those versions.
• →Review agent activity logs for writes to home-directory or system paths (~/.ssh, ~/.zshrc, /etc, autostart/scheduler locations) that weren't explicitly requested by the user.
• →Run coding agents with restricted filesystem permissions so they cannot write outside the intended project directory regardless of application-level checks.
• →Treat AI-agent write commands to credential files, shell init files, or MCP/editor config as requiring explicit user confirmation, and flag any that occur without a matching user request.

Known benign look-alikes

• Toolchain installers the agent legitimately runs on request (nvm, rustup, pyenv, sdkman, `brew shellenv`) append their init lines to ~/.zshrc or ~/.bashrc via a redirect.
• Dev-environment bootstrap the user asked for that writes ~/.gitconfig, ~/.npmrc or ~/.docker/config.json by redirect instead of the tool's own config subcommand.
• The user explicitly asking the agent to add an MCP server or change editor settings, producing a write to ~/.cursor/mcp.json or Library/Application Support/Cursor.
• Container or CI entrypoint scripts run by the agent that write to /etc or /usr/local/bin inside an ephemeral image.
• {'Monorepo build scripts that emit artifacts through deep relative paths (mitigated': 'two or more ../ with a redirect/tee, three or more for cp/mv/rsync/install).'}
• Heredocs or shell snippets that echo tutorial commands, when the placeholder filters do not catch the wording.

References

• https://attack.mitre.org/techniques/T1546/004/
• https://genai.owasp.org/llmrisk/llm06-excessive-agency/

Related threats