Cato AI Labs has disclosed DuneSlide, a pair of critical remote-code-execution flaws in Cursor, the AI code editor that Cursor says is used by more than half the Fortune 500. The flaws — CVE-2026-50548 and CVE-2026-50549 — are rated CVSS 9.8, or 9.3 under CVSS 4.0, and allow a zero-click indirect prompt injection to escape Cursor's terminal sandbox and run commands outside it. Both are fixed in Cursor 3.0, released on 2 April 2026; versions before 3.0 are affected. Cato presents the work as research, and public reporting says there is no evidence of in-the-wild exploitation as of disclosure — but the reason the flaws matter goes beyond one editor: they are a concrete demonstration that prompt injection has become a route to code execution, not just to manipulating a model's output.

How a prompt becomes code execution

The attack surface here is the part worth internalising. An AI coding agent does not only act on what the developer types into the chat box; it reads content on the developer's behalf — project files, pages returned by a web search, and responses from services connected through the Model Context Protocol (MCP). Indirect prompt injection is the technique where malicious instructions are not written by the user but hidden inside that content, so that the agent ingests and acts on them as if they were the user's own request. The developer issues an innocuous prompt; the agent, in the course of fulfilling it, reads an attacker-controlled MCP response or a poisoned search result and quietly follows the instructions buried in it. That is why the attack is zero-click: the only action required of the victim is a normal, benign prompt.

To limit what an agent's commands can do, Cursor runs them inside a terminal sandbox by default in its 2.x line. DuneSlide is about getting out of that box. Both flaws exploit edge cases in how the sandbox validates its own boundaries — one in how it trusts a path the agent supplies, the other in how it resolves symbolic links when a safety check fails — to write to the very component that enforces the sandbox. Once that component is overwritten, subsequent commands in the same injection run without restriction. The result is OS-level code execution — control of the developer's machine and, in Cato's assessment, of connected cloud or SaaS workspaces the editor is signed into. In keeping with responsible disclosure, this article describes the flaws at that conceptual level and does not reproduce the exploitation steps, the targeted file paths or a proof-of-concept; the operational point is the class of failure, not a working exploit.

Why this is bigger than one editor

The systemic argument is Cato's, and it is the real news. Prompt injection is often treated as a model-layer problem: the model can be tricked into saying or doing something unintended. DuneSlide shows the injected instruction reaching past the model and into the surrounding tool's ordinary code paths — parameter validation, path handling and sandbox enforcement, which were never traditionally considered part of the AI attack surface. The flaw is not that the model was fooled; it is that a fooled model was holding a lever connected to the operating system.

That reframes what a sandbox is for. Sandboxing an agent's commands is a necessary defence, but DuneSlide demonstrates that it is not a sufficient one: if the logic that builds and enforces the sandbox can itself be steered by attacker-controlled input, the boundary can be dismantled from the inside. Cato says it is applying the same research to other popular coding agents and frames DuneSlide as evidence of a structural problem rather than a Cursor-specific bug. That claim has history behind it. Cursor has worked through a run of prompt-injection-to-execution flaws over the past year — among them CurXecute (CVE-2025-54135) and MCPoison (CVE-2025-54136) — each defeating a different guardrail; the 2.x sandbox was in part the answer to that earlier wave, and DuneSlide is about escaping the answer.

The disagreement over scope

The disclosure timeline includes a detail other agent vendors should watch. Cato reported the issues to Cursor in February 2026, and the reports were initially declined on the grounds that misuse of an MCP server fell outside Cursor's threat model; after the researchers escalated, the reports were reopened and triaged. SecurityWeek reports that patches for both flaws were included in Cursor 3.0, released on 2 April, while the CVE IDs were assigned in early June. The underlying question — whether untrusted content arriving through MCP or a web search is inside an agent tool's threat model — is not unique to Cursor. Any vendor building an autonomous agent that reads external content now has to answer it, and the position that such content is out of scope is an increasingly hard line to hold once the content can reach code execution.

What teams should do

  • Update to Cursor 3.0 or later. The flaws are fixed there; every earlier version is exposed, so an inventory of who is still on the 2.x line is the first step for any organisation running it at scale.

  • Treat everything the agent reads as untrusted input. MCP responses, web-search results and even project files are part of the input surface, not just the developer's typed prompt. Apply the same suspicion to them that you would to any external data entering a privileged process.

  • Constrain what the agent can reach and do. Limit which MCP servers and tools an agent is connected to, prefer trusted and vetted ones, and apply least privilege to the agent's ability to execute commands and write files — especially outside the project directory.

  • Isolate the blast radius. Where an agent has access to source code, secrets and internal networks, assume a successful injection reaches all of it, and separate those concerns (scoped credentials, restricted network egress) accordingly.

  • Track the vendor's guidance. Follow Cato's research and Cursor's advisories for specifics and for the broader set of coding-agent disclosures Cato has signalled are coming.

Key Takeaways

  • Cato AI Labs disclosed DuneSlide — two critical RCE flaws in the Cursor AI code editor (CVE-2026-50548 and CVE-2026-50549, CVSS 9.8 / 9.3 on CVSS 4.0) — that let a zero-click, indirect prompt injection escape Cursor's terminal sandbox and execute code on the developer's machine and connected SaaS workspaces.

  • The injection arrives through content the agent reads on the user's behalf — an MCP server response or a poisoned web-search result — during an ordinary prompt, requiring no click or approval from the victim; the flaws are patched in Cursor 3.0 (2 April 2026), all earlier versions are affected, and there is no evidence of exploitation in the wild.

  • The significance is systemic: the injection reaches past the model layer into the tool's own parameter-validation and path-resolution code, showing that sandboxing an autonomous agent is necessary but not sufficient when the input steering the agent can also steer the sandbox logic. Cato says it is applying similar research to other coding agents.

  • What to do: update to Cursor 3.0+, treat all agent-ingested content (MCP, web results, files) as untrusted input, constrain which tools and MCP servers the agent can reach, apply least privilege to its execute/write abilities, and isolate access to secrets and internal networks so a single injection cannot reach everything.