Executive Summary
Cursor on Windows runs a git.exe placed in a cloned repo's root when the project is opened, with no prompt, executing as the user.
What Happened
Open a repository in Cursor on Windows and, if a file named git.exe is sitting in the project root, Cursor runs it. No click, no approval dialog, no warning that anything in the folder is about to execute. Whatever that binary does, it does as you, with your source, your SSH keys and your cloud tokens. Cursor keeps re-running it for as long as the project stays open. No prompt
Affected Products
- Cursor
Vulnerability / Attack Technique
Malicious repository triggering code execution in an AI IDE
Technical Mechanism
The IDE resolves git.exe from the project folder.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Opening a repo should not run code. RealGround analysis: AI IDEs carry classic path-hijack bugs.
Recommended Controls
- Update Cursor
- Open untrusted repos in a sandbox
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/cursor-flaw-lets-malicious-cloned.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.