Indirect Prompt Injection in AI Coding Agents: Cursor, Claude Code, and Codex Desktop
Research utilizing the IssueTrojanBench framework reveals a critical vulnerability in AI-driven coding agents where indirect prompt injection via software issue artifacts bypasses existing security guardrails. By embedding malicious instructions in non-obvious locations—specifically image alt-text, PDF attachments, and GitHub issue comments—attackers can manipulate agents into executing unauthorized code or exfiltrating data. Testing across 4,176 runs showed an average bypass rate of 66.5%, with Codex Desktop reaching 79.2% and Cursor at 66.5%. This vulnerability introduces a significant supply-chain risk, as agents performing routine tasks like "fixing bugs" may inadvertently trigger malicious payloads on a developer's local workstation.
Critical OS-Level RCE via "DuneSlide" in Cursor AI
Researchers at Cato Networks have identified "DuneSlide," a pair of critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the Cursor AI IDE. These flaws enable prompt-injection-driven sandbox escapes, escalating from LLM interactions to full operating system-level Remote Code Execution (RCE). Attackers can leverage malicious Model Context Protocol (MCP) servers or poisoned web search results to manipulate the run_terminal_cmd tool and bypass path canonicalization logic via symbolic links. Successful exploitation allows unauthorized file writes outside the project root, enabling attackers to overwrite the cursorsandbox executable, modify shell configurations, or establish persistence via macOS LaunchAgents, resulting in total system compromise.