--- title: "DuneSlide: Cursor's Agent Overwrote Its Own Sandbox Binary - CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8)" description: "DuneSlide: two CVSS 9.8 flaws let zero-click prompt injection overwrite Cursor's own sandbox binary, turning sandboxed commands into full RCE." url: "https://anomity.ai/blog/duneslide-cursor-sandbox-escape-cve-2026-50548-50549/" source: html --- On this page - What happened - Why this is an agentic-endpoint risk - How Anomity surfaces and governs it - What to check across your fleet - Frequently asked questions [← Back to blog](https://anomity.ai/blog/) - Home - Blog - DuneSlide: Cursor's Agent Overwrote Its Own Sandbox Binary - CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8) ![Anomity robot illustrating DuneSlide: Cursor's Agent Overwrote Its Own Sandbox Binary - CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8)] Advisory Critical # DuneSlide: Cursor's Agent Overwrote Its Own Sandbox Binary - CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8) Anomity Research Anomity Threat Research · Aug 5, 2026 · 7 min read Share: Copied Agent Self-Modification · Critical · CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8), named DuneSlide by Cato Networks · Aug 5, 2026 Affected Cursor IDE - every version before 3.0; both issues patched in Cursor 3.0, released April 2 2026 **DuneSlide**, disclosed by **Cato Networks**, is a pair of **CVSS 9.8** vulnerabilities in **Cursor IDE** - **CVE-2026-50548** and **CVE-2026-50549** - that let **zero-click prompt injection** escape the IDE sandbox and run code on the operating system. The victim never clicks anything: they issue an innocuous prompt that happens to ingest attacker-controlled content, such as an **MCP server response or a poisoned web search result**. Both bugs converge on the same endgame - **overwriting Cursor's own sandbox helper binary** - after which every subsequent terminal command runs with **no sandbox at all**. Every version before **Cursor 3.0** is affected; both are fixed in 3.0, released **April 2, 2026**. This advisory covers the two mechanisms, why writing to your own guardrail is the pattern to watch, and what to check across a fleet. ## What happened Cursor runs agent terminal commands inside a sandbox, enforced on macOS by a helper binary at `/Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox`. That binary is the boundary. Both CVEs are different routes to writing over it. **CVE-2026-50548** abuses the sandbox's own generosity about working directories. Cursor's `run_terminal_cmd` tool takes an optional **working_directory** parameter, and the sandbox permits writes into a command's working folder. When the agent sets that parameter to a **non-default path**, Cursor **adds the path to the allowed-write list without question**. Point it at the directory containing `cursorsandbox`, and the sandbox authorises the write that destroys it. Later commands then run unsandboxed. **CVE-2026-50549** abuses a safety check's failure mode. Before writing, Cursor resolves symlinks to confirm the real destination sits inside the project. The bug is the **fallback**: when resolution **fails** - because the target does not exist, or because an attacker has **removed read permissions from a directory in the path** - Cursor gives up and **trusts the unvalidated symlink path**. A check that fails open is not a check. The attacker does not need to defeat canonicalization; they need only to make it error. The trigger is what earns the *zero-click* label. Neither bug requires elevated privileges or deliberate user action. The victim issues an ordinary prompt - summarise this, look that up, use this tool - and the agent ingests attacker-controlled text from an **MCP server response** or a **poisoned search result**. From there the injected instructions drive the file write. Cato's demonstrated impact is overwriting `cursorsandbox` to convert sandboxed terminal commands into **fully unsandboxed RCE**, compromising **both the local machine and connected SaaS workspaces** - because the IDE holds tokens for everything it is wired into. Detail Value Name DuneSlide (Cato Networks) Identifiers CVE-2026-50548, CVE-2026-50549 Severity CVSS 9.8 (Critical), both Product Cursor IDE Affected Every version before 3.0 Fixed in Cursor 3.0, released April 2 2026 CVE-2026-50548 `working_directory` on `run_terminal_cmd` is added to the allowed-write list unchecked CVE-2026-50549 Symlink canonicalization fails open - unresolvable or permission-denied paths are trusted Trigger Zero-click: an innocuous prompt ingests attacker content from an MCP response or poisoned search result Endgame Overwrite `cursorsandbox` helper, then run unsandboxed Impact OS-level RCE; local machine and connected SaaS workspaces Reported by Cato Networks ## Why this is an agentic-endpoint risk The sandbox was not bypassed. It was **edited**. That is the difference between a containment bug and this class: the agent had write access to the artifact that constrained it, so the constraint became just another file. The same logic produced [CVE-2026-10591 in AWS Kiro](https://anomity.ai/blog/kiro-mcp-config-rewrite-cve-2026-10591/), where hidden text on a web page made the agent rewrite its own `mcp.json` and auto-reload it. Kiro's target was a config; Cursor's was a binary. **Agent self-modification** is the shared class, and it converts a transient injection into durable capability. CVE-2026-50549 also deserves attention as a general lesson in check design. The validation logic was correct; its **error path** was not. Resolve-then-trust-on-failure is a pattern that appears throughout agent tooling, because agents operate on paths that legitimately may not exist yet, so *cannot resolve* feels like a normal condition rather than a refusal. An attacker only has to induce the error - here by removing read permission on a parent directory. Any allow-list, path check or sandbox rule in an agent harness deserves the question: **what does it do when it cannot decide?** Detection is genuinely hard from the outside. The injected content is a legitimate tool response. The write is a signed IDE writing inside its own application directory, which it does during every update. The subsequent unsandboxed commands are the same commands the agent was already permitted to run. EDR sees a trusted application; DLP sees nothing leave at rest. The tractable questions are fleet questions - **which endpoints run Cursor before 3.0, which MCP servers can feed them content, and what are their tool calls allowed to do** - and MCP servers are one of the [eight AI artifact types](https://anomity.ai/#features) Anomity inventories per endpoint. The injection mechanism itself is covered in [indirect prompt injection explained](https://anomity.ai/blog/indirect-prompt-injection-explained/), and the data-egress shape in the [lethal trifecta](https://anomity.ai/blog/lethal-trifecta-ai-agent-data-exfiltration/). ## How Anomity surfaces and governs it First, **inventory versions and the content sources feeding the agent**. Anomity's unprivileged Endpoint Sensor runs on Windows, macOS and Linux and inventories AI agents, MCP servers, extensions, plugins, skills, secrets, hooks and CLIs. "Which endpoints run Cursor before 3.0" is one query, and so is "which MCP servers are wired into them" - the second matters more here, because an MCP response is the delivery vehicle for a zero-click injection. Second, **decide at the tool call**. Neither DuneSlide bug involved a user approving anything, so no consent-based control was ever in the path. Where an agent exposes a hook - for example the **PreToolUse** event in Claude Code - Anomity evaluates each call against policy and returns **allow, deny, or log** before it runs. A write targeting an application directory, a sandbox helper, or anything outside the project is exactly the sort of call that should be denied irrespective of which prompt produced it. That is what [runtime governance](https://anomity.ai/#runtime-governance) provides when the instruction arrived inside a tool response. Third, **keep the record**. Version changes, artifact changes and policy decisions land in a [queryable 90-day audit trail](https://anomity.ai/#outcomes), giving a precise exposure window - which machines ran a pre-3.0 build, for how long, and what their agents did. Anomity collects **metadata only**, with **on-endpoint secret redaction**, so the SaaS tokens this attack reaches for are never centralized. Findings route to **SIEM, Slack, email, or Jira**, the platform is **SOC 2 Type II**, and it [complements EDR, DLP, network and GRC tooling](https://anomity.ai/#compare). See [how it works](https://anomity.ai/#how-it-works). > You can't govern what you can't see. The Anomity principle ## What to check across your fleet - Inventory every endpoint running Cursor and record the build. Every version before 3.0 is affected; 3.0 shipped April 2 2026. Verify the running build rather than trusting the updater. - Verify the integrity of the sandbox helper on macOS - /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox - on any endpoint that ran a pre-3.0 build, since an overwrite persists across restarts. - Note that patching to 3.0 does not clear DeepJack, a separate deeplink issue reported still reproducible in 3.9.8 with no CVE and no vendor advisory - see the DeepJack advisory . - Enumerate which MCP servers can return content into Cursor, and treat every tool response as untrusted input rather than trusted data - that is the zero-click delivery path. - Audit your own agent harnesses for checks that fail open. Wherever a path check, allow-list or sandbox rule can fail to resolve, confirm the failure denies rather than trusts. - Restrict agent write scope to the project tree and deny writes into application directories outright, regardless of any working-directory parameter the agent supplies. - For endpoints that ran a pre-3.0 build with active agent use, treat as a potential incident: rotate developer credentials and the SaaS tokens the IDE held, then review connected workspaces for unexpected activity. - Confirm tool calls are evaluated at a hook with allow/deny/log - see Claude Code permissions and hooks hardening - and run the credential path of your AI agent incident response playbook . DuneSlide is two CVSS 9.8 routes to the same destination: **the agent writing over the thing that was supposed to contain it**, triggered by text it read rather than anything the user clicked. Patch to Cursor 3.0 or later, verify the sandbox helper on anything that ran an older build, and then stop treating tool responses as trusted data. For the same class against a config file see the [Kiro advisory](https://anomity.ai/blog/kiro-mcp-config-rewrite-cve-2026-10591/); for the consent-handoff variants see [DeepJack](https://anomity.ai/blog/deepjack-cursor-deeplink-mcp-install-rce/) and [PromptFiction](https://anomity.ai/blog/promptfiction-claude-desktop-url-scheme-one-click/); for the trust model, the [MCP Server Security guide](https://anomity.ai/blog/mcp-server-security-complete-guide/) and [securing AI coding agents and CLIs](https://anomity.ai/blog/securing-ai-coding-agents-and-clis/). To see which endpoints run a vulnerable build and what [runtime governance](https://anomity.ai/#runtime-governance) would deny, [book a demo](https://anomity.ai/#early-access). Related Git trust failures on coding endpoints continue - see [GitSpawn](https://anomity.ai/blog/gitspawn-malicious-git-config-coding-agent-rce/) for malicious `.git/config` helpers that run during agent context gather. Share: Copied ## Frequently asked questions What are CVE-2026-50548 and CVE-2026-50549 (DuneSlide)? DuneSlide is the name Cato Networks gave to a pair of CVSS 9.8 vulnerabilities in Cursor IDE that allow zero-click prompt injection to escape the IDE sandbox and achieve operating-system level remote code execution. CVE-2026-50548 abuses the optional working_directory parameter on Cursor's run_terminal_cmd tool: the sandbox permits writes into a command's working folder, and when the agent sets that parameter to a non-default path Cursor adds it to the allowed-write list without question. CVE-2026-50549 abuses the symlink canonicalization check's failure mode - when resolution fails, Cursor trusts the unvalidated path. Both converge on overwriting Cursor's own sandbox helper binary, after which subsequent terminal commands run with no sandbox at all. Which Cursor versions are affected and where is the fix? Every version before Cursor 3.0 is affected. Both issues were patched in Cursor 3.0, released April 2 2026. Two caveats matter. First, if an endpoint ran a vulnerable build with active agent use, verify the integrity of the sandbox helper binary - on macOS at /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox - because an overwrite persists across restarts and is not undone by upgrading. Second, patching to 3.0 does not address DeepJack, a separate Cursor deeplink issue that Adversa AI reported as still reproducible in build 3.9.8, with no CVE and no vendor advisory. What makes this zero-click? Neither bug requires elevated privileges or any deliberate user action beyond normal use. The victim issues an innocuous prompt - summarise this page, look something up, use a particular tool - and in servicing it the agent ingests attacker-controlled content from an untrusted source such as an MCP server response or a poisoned web search result. The injected instructions then drive the file write. There is no malicious link to click and no dialog to approve, which is why controls that depend on user consent are not in the path at all. Why is overwriting the sandbox binary worse than a normal sandbox escape? Because it is persistent and silent. A conventional escape gets code out of the sandbox for one operation. Overwriting the helper binary means the sandbox is no longer enforcing anything for any subsequent command, in that session or later ones, and nothing in the IDE's behaviour signals that the boundary is gone. It also means remediation is not just patching: the modified binary stays modified until it is verified or reinstalled. This is the defining property of agent self-modification - a transient injection becomes durable capability by editing the mechanism that was meant to constrain it. What is the broader lesson from the symlink bug? That a check which fails open is not a check. Cursor's validation logic was correct in principle - resolve symlinks, confirm the destination is inside the project - but when resolution failed it trusted the unvalidated path. An attacker therefore never needed to defeat canonicalization, only to make it error, which they could do by removing read permissions from a directory in the path or pointing at something that does not exist. This pattern is especially common in agent tooling because agents legitimately operate on paths that may not exist yet, so cannot resolve feels like a normal condition. Any allow-list, path check or sandbox rule in an agent harness should be tested for what it does when it cannot decide. How does DuneSlide relate to the Kiro config-rewrite flaw? They are the same class against different artifacts. In CVE-2026-10591, hidden 1-pixel text on a web page caused AWS Kiro to rewrite its own ~/.kiro/settings/mcp.json and auto-reload it, launching an attacker-defined MCP server as code execution. In DuneSlide, injected content caused Cursor to overwrite its own sandbox helper binary. Kiro's target was a configuration file, Cursor's was an executable, but in both cases the agent held write access to the mechanism that was supposed to constrain it, and untrusted text it merely read was enough to trigger the write. AWS's fix - a protected-paths list requiring explicit approval, enforced even in the most autonomous mode - is the right shape of answer for both. ## Related [Advisory High ### AWS Kiro Rewrote Its Own mcp.json From Hidden Text on a Web Page - CVE-2026-10591 CVE-2026-10591: hidden 1px text on a web page made AWS Kiro rewrite its own mcp.json and auto-reload it, executing attacker code. Fixed in v0.11.130. Anomity Research · Aug 5, 2026 · CVE-2026-10591 (CVSS 3.1 8.8 / CVSS 4.0 8.6)](https://anomity.ai/blog/kiro-mcp-config-rewrite-cve-2026-10591/) [Advisory High ### BragJack: One Extension Hijacks the Built-In AI in Chrome, Comet, Edge, Opera Neon and Claude - CVE-2026-0628 An ordinary browser extension can impersonate the vendor page that commands a built-in AI agent, then drive it. Five browsers, two CVEs, zero clicks. Anomity Research · Sep 18, 2026 · CVE-2026-0628, CVE-2026-55945](https://anomity.ai/blog/bragjack-browser-extension-ai-assistant-hijack/) [Advisory Critical ### GitSpawn - Malicious .git Configs Make Coding Agents Run Attacker Code Manifold's GitSpawn (Sep 1 2026): malicious .git/config core.fsmonitor runs on git status/diff during agent context gather - outside sandbox, no approval. Patched in goose, Codex, Cursor, Claude Code; several agents still open. Anomity Research · Sep 14, 2026 · GitSpawn (Manifold, 2026-09-01); CVE-2026-72718 (goose), CVE-2026-19592 (Codex CLI), CVE-2026-71963 (Hermes)](https://anomity.ai/blog/gitspawn-malicious-git-config-coding-agent-rce/) ## Structured data ```json { "@context": "https://schema.org", "@type": "TechArticle", "headline": "DuneSlide: Cursor's Agent Overwrote Its Own Sandbox Binary - CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8)", "description": "DuneSlide: two CVSS 9.8 flaws let zero-click prompt injection overwrite Cursor's own sandbox binary, turning sandboxed commands into full RCE.", "datePublished": "2026-08-05", "dateModified": "2026-08-05", "author": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, "publisher": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ], "logo": { "@type": "ImageObject", "url": "https://anomity.ai/icon-512.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://anomity.ai/blog/duneslide-cursor-sandbox-escape-cve-2026-50548-50549/" }, "image": { "@type": "ImageObject", "url": "https://anomity.ai/assets/blog/covers/prompt-injection.jpg", "width": 1200, "height": 630 }, "articleSection": "Agent Self-Modification", "url": "https://anomity.ai/blog/duneslide-cursor-sandbox-escape-cve-2026-50548-50549/", "keywords": "DuneSlide Cursor CVE-2026-50548, CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8), named DuneSlide by Cato Networks, DuneSlide, CVE-2026-50548, CVE-2026-50549, Cursor, sandbox escape, zero-click prompt injection, symlink, agentic AI security" } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What are CVE-2026-50548 and CVE-2026-50549 (DuneSlide)?", "acceptedAnswer": { "@type": "Answer", "text": "DuneSlide is the name Cato Networks gave to a pair of CVSS 9.8 vulnerabilities in Cursor IDE that allow zero-click prompt injection to escape the IDE sandbox and achieve operating-system level remote code execution. CVE-2026-50548 abuses the optional working_directory parameter on Cursor's run_terminal_cmd tool: the sandbox permits writes into a command's working folder, and when the agent sets that parameter to a non-default path Cursor adds it to the allowed-write list without question. CVE-2026-50549 abuses the symlink canonicalization check's failure mode - when resolution fails, Cursor trusts the unvalidated path. Both converge on overwriting Cursor's own sandbox helper binary, after which subsequent terminal commands run with no sandbox at all." } }, { "@type": "Question", "name": "Which Cursor versions are affected and where is the fix?", "acceptedAnswer": { "@type": "Answer", "text": "Every version before Cursor 3.0 is affected. Both issues were patched in Cursor 3.0, released April 2 2026. Two caveats matter. First, if an endpoint ran a vulnerable build with active agent use, verify the integrity of the sandbox helper binary - on macOS at /Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox - because an overwrite persists across restarts and is not undone by upgrading. Second, patching to 3.0 does not address DeepJack, a separate Cursor deeplink issue that Adversa AI reported as still reproducible in build 3.9.8, with no CVE and no vendor advisory." } }, { "@type": "Question", "name": "What makes this zero-click?", "acceptedAnswer": { "@type": "Answer", "text": "Neither bug requires elevated privileges or any deliberate user action beyond normal use. The victim issues an innocuous prompt - summarise this page, look something up, use a particular tool - and in servicing it the agent ingests attacker-controlled content from an untrusted source such as an MCP server response or a poisoned web search result. The injected instructions then drive the file write. There is no malicious link to click and no dialog to approve, which is why controls that depend on user consent are not in the path at all." } }, { "@type": "Question", "name": "Why is overwriting the sandbox binary worse than a normal sandbox escape?", "acceptedAnswer": { "@type": "Answer", "text": "Because it is persistent and silent. A conventional escape gets code out of the sandbox for one operation. Overwriting the helper binary means the sandbox is no longer enforcing anything for any subsequent command, in that session or later ones, and nothing in the IDE's behaviour signals that the boundary is gone. It also means remediation is not just patching: the modified binary stays modified until it is verified or reinstalled. This is the defining property of agent self-modification - a transient injection becomes durable capability by editing the mechanism that was meant to constrain it." } }, { "@type": "Question", "name": "What is the broader lesson from the symlink bug?", "acceptedAnswer": { "@type": "Answer", "text": "That a check which fails open is not a check. Cursor's validation logic was correct in principle - resolve symlinks, confirm the destination is inside the project - but when resolution failed it trusted the unvalidated path. An attacker therefore never needed to defeat canonicalization, only to make it error, which they could do by removing read permissions from a directory in the path or pointing at something that does not exist. This pattern is especially common in agent tooling because agents legitimately operate on paths that may not exist yet, so cannot resolve feels like a normal condition. Any allow-list, path check or sandbox rule in an agent harness should be tested for what it does when it cannot decide." } }, { "@type": "Question", "name": "How does DuneSlide relate to the Kiro config-rewrite flaw?", "acceptedAnswer": { "@type": "Answer", "text": "They are the same class against different artifacts. In CVE-2026-10591, hidden 1-pixel text on a web page caused AWS Kiro to rewrite its own ~/.kiro/settings/mcp.json and auto-reload it, launching an attacker-defined MCP server as code execution. In DuneSlide, injected content caused Cursor to overwrite its own sandbox helper binary. Kiro's target was a configuration file, Cursor's was an executable, but in both cases the agent held write access to the mechanism that was supposed to constrain it, and untrusted text it merely read was enough to trigger the write. AWS's fix - a protected-paths list requiring explicit approval, enforced even in the most autonomous mode - is the right shape of answer for both." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anomity.ai/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://anomity.ai/blog/" }, { "@type": "ListItem", "position": 3, "name": "DuneSlide: Cursor's Agent Overwrote Its Own Sandbox Binary - CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8)", "item": "https://anomity.ai/blog/duneslide-cursor-sandbox-escape-cve-2026-50548-50549/" } ] } ```