Executive brief
Cursor is an AI-assisted code editor for macOS that can automatically run code suggestions in a sandboxed environment. When Docker Desktop and Dev Containers are installed, a malicious AI agent can escape the sandbox by launching a privileged Docker container that mounts the host's filesystem, allowing full read/write access to the user's home directory and execution of arbitrary commands with the user's privileges. An attacker could steal source code, credentials, and personal files, or inject malicious code into the development environment.
Technical details
The vulnerability is a sandbox escape in Cursor IDE's Auto-Run Sandbox mode on macOS. The root cause is insufficient isolation when Docker Desktop and Dev Containers CLI are present; a malicious agent can execute commands to launch a privileged container that mounts Docker's virtiofs0, bypassing sandbox restrictions. The attack requires the agent to be running in Auto-Run Sandbox mode (default behavior) and Docker Desktop with Dev Containers CLI to be installed on the system. An attacker can achieve full filesystem access and host command execution with the user's privileges without triggering additional permission prompts. The vulnerability is fixed in Cursor IDE version 3.0.0 and later.
Affected products
- Cursor Cursor IDE prior to 3.0.0
Timeline
- 2026-07-14: disclosed
- 2026-08-11: patched: fixed in version 3.0.0
- 2026-08-11: advisory