Security researchers disclosed a flaw in Cursor’s command-line coding agent that let a cloned repository run arbitrary commands on a developer’s machine before the workspace-trust dialog appeared, even when the sandbox flag was explicitly enabled. A tracked configuration file, .cursor/worktrees.json, was read from the repository and passed directly to a shell with no parsing, allowlist, or prompt, letting a malicious repo read SSH keys, steal cloud credentials, or open a reverse shell the moment a developer ran the CLI agent against it. Researchers disclosed the issue to Cursor on July 20, 2026, and Cursor shipped a fix on July 23, 2026 that moves the trust prompt before the setup command runs.