Cursor DuneSlide
When: Public detail Jul 1, 2026 (CVE-2026-50548, CVE-2026-50549, CVSS 9.8); fix in Cursor 3.0
Surface: Cursor · MCP / web-search ingested content → sandbox escape → OS-level RCE
Class: Prompt injection + path/trust bugs in the agent sandbox
Cato Networks (and The Hacker News / SecurityWeek) described a chain where injected instructions from an MCP server or search result could overwrite sandbox enforcement via working-directory trust and a fail-open symlink check—reaching host RCE with no deliberate user click. See awesome-ai-agent-attacks (DuneSlide entry) and related “Week of Sandbox Escapes” research on Cursor/Codex/Gemini CLI.
Without Relay
- Untrusted content entered the agent context and drove file writes and shell outside what the engineer intended.
- Org policy lived in “don’t open weird repos,” not on each PreToolUse / beforeShell / beforeReadFile decision.
- After compromise, laptop forensics replaced a clean tool-decision trail.
How Relay could have safeguarded
Relay cannot patch a vendor sandbox CVE by itself—but it narrows what injected instructions are allowed to request while you upgrade:
| Layer | What to configure | Effect on this path |
|---|---|---|
| Prompt control | Deny / Soft ask on jailbreak, “ignore system,” secret-exfil phrasing; redact secret markers | Injected payloads are harder to keep in context |
| Path control | Deny writes outside the workspace; deny sensitive binaries / ~/.ssh; Soft ask on unexpected absolute paths | Overwriting sandbox/enforcer paths is blocked at the hook |
| Bash control | Deny curl | sh, download-and-exec, chmod 777, suspicious rewrite of agent binaries | Post-injection shell payloads fail closed |
| MCP control | Allowlist only trusted MCP servers | Malicious MCP is not a free instruction channel |
| Destructive Burst / Privilege Streak | Pattern backstop | Rapid sensitive writes / privilege actions escalate |
Retro checklist
- Patch / upgrade the IDE first (vendor fix is mandatory).
- Until then, tighten path write allows to repo prefixes only.
- Default-deny unknown MCP; treat web-browse tools as high risk.
- Keep audit retention long enough to reconstruct pre-patch sessions.
Relay evaluates actions the hooks see. A true sandbox escape that never surfaces as a governed tool call is outside the hook boundary—still patch. Use Relay so most injected plans die at bash/path/MCP before they reach that edge.
Related: Prompt · Path · Bash · Case studies overview