Daily AI Security Intelligence

Cursor DuneSlide flaws turn indirect prompt injection into zero‑click OS‑level RCE

Cato AI Labs disclosed two critical Cursor IDE vulnerabilities, CVE-2026-50548 and CVE-2026-50549, showing that indirect prompt injection delivered via untrusted MCP responses or web content can escape the editor’s sandbox and execute arbitrary commands on a developer’s machine.[1][3][8] Both flaws, collectively dubbed DuneSlide, abuse working-directory and symlink-validation logic so a single prompt can steer the agent to overwrite the sandbox helper and run unsandboxed commands under the user’s privileges.[1][4][6] Reporting emphasizes that exploitation requires no explicit user approval and can be triggered when an innocuous user request causes the agent to ingest attacker-controlled content, making this a practical zero-click prompt injection pathway.[1][8][9] Cursor 3.0 and later ship fixes, but any pre‑3.0 deployment remains exposed until updated and lacks runtime detection for sandbox escape attempts.[1][6] RealGround analysis: this is a high-severity prompt injection and trust-boundary failure where model-readable content becomes an RCE vector; organizations should treat all external agent inputs as untrusted, harden tool invocation boundaries, and prioritize struct

2026-07-31 prompt injection RealGround analysis
Run AI Security Assessment Talk to AI CISO Download Daily Brief
Top risk today prompt injection
Affected industries Healthcare, Fintech, SaaS, SMB, AI startups
Highest severity signal Cursor DuneSlide flaws turn indirect prompt injection into zero‑click OS‑level RCE
Recommended action Review agent permissions, data access, approval gates, and prompt-injection test coverage.
Relevant RealGround service Secure AI Agent Build

What Happened

Cato AI Labs disclosed two critical Cursor IDE vulnerabilities, CVE-2026-50548 and CVE-2026-50549, showing that indirect prompt injection delivered via untrusted MCP responses or web content can escape the editor’s sandbox and execute arbitrary commands on a developer’s machine.[1][3][8] Both flaws, collectively dubbed DuneSlide, abuse working-directory and symlink-validation logic so a single prompt can steer the agent to overwrite the sandbox helper and run unsandboxed commands under the user’s privileges.[1][4][6] Reporting emphasizes that exploitation requires no explicit user approval and can be triggered when an innocuous user request causes the agent to ingest attacker-controlled content, making this a practical zero-click prompt injection pathway.[1][8][9] Cursor 3.0 and later ship fixes, but any pre‑3.0 deployment remains exposed until updated and lacks runtime detection for sandbox escape attempts.[1][6] RealGround analysis: this is a high-severity prompt injection and trust-boundary failure where model-readable content becomes an RCE vector; organizations should treat all external agent inputs as untrusted, harden tool invocation boundaries, and prioritize struct

Why This Matters

AI systems increasingly connect natural-language decisions to SaaS integrations, internal data, memory stores, API calls, and production workflows. A signal that appears narrow in a vendor report can become broader business risk when it intersects with autonomous tools or sensitive context.

Healthcare Fintech SaaS SMB AI startups

RealGround Analysis

This trend increases exposure to indirect prompt injection, unauthorized tool execution, sensitive data disclosure, and weak human approval workflows for organizations deploying LLM agents or AI-enabled automation.

Recommended Actions

  • Upgrade Cursor to 3.0 or later and inventory all AI coding/agent tools for similar sandbox and auto-run terminal behaviors, treating pre-patch versions as high-risk.[1][6][7]
  • Separate model instructions from untrusted content (MCP responses, web results, documents) with explicit context boundaries so external text cannot silently override system or tool-use policies.
  • Run adversarial prompt tests against every exposed agent workflow, specifically targeting sandbox boundaries, file-write paths, and terminal/command tools to detect prompt-induced escapes.[3][7][8]
  • Log prompts, agent decisions, and downstream tool calls in a central store to support incident detection and post-compromise investigation of prompt-injection-driven behavior.
  • Require human approval or strong policy gating before any model output can change local files, execute shell commands, or alter production systems, especially in IDEs and DevOps pipelines.
  • Restrict and monitor MCP and other integration endpoints so agents cannot ingest unvetted external content with implicit trust, and regularly review hooks, task definitions, and workspace scripts for non-human-authored changes.[1][6][7]
  • Restrict agent permissions with least-privilege tool scopes.
  • Add human approval workflows for state-changing actions.
  • Review SaaS integrations, memory persistence, and data access paths.
  • Test prompt injection and indirect prompt injection scenarios before production rollout.

Relevant RealGround Service

Secure AI Agent Build Schedule security review AI Agent Business Logic Audit Schedule security review Continuous AI Red Teaming Schedule security review AI Security Readiness Assessment Schedule security review AI Policy Generator & Support Schedule security review AI CISO Advisory Schedule security review

Sources

Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks Critical Gitea Flaw Under Active Exploitation, Researchers Warn EchoLeak: A Real-World Zero-Click Prompt Injection Vulnerability in Microsoft 365 Copilot
Talk to AI CISO