Cursor, Anysphere's AI-native code editor, has become one of the fastest-scaling developer tools ever built, reaching nearly $4 billion in annualized revenue by mid-2026, but a cascade of unpatched security vulnerabilities threatens to undermine that growth by giving attackers direct access to developers' most sensitive credentials.

How Is Cursor Becoming So Valuable So Fast?

Cursor crossed $2 billion in annualized revenue in February 2026, roughly three years from founding, and by June 2026, reporting put the figure near $4 billion. The company achieved this scale with a remarkably small team, generating roughly $2.7 million in revenue per employee, compared to a median of $141,000 for private SaaS companies. This efficiency reflects a broader shift in how software gets built: the cost of developing software has collapsed, with inference prices falling 280 times in just two years, while AI capabilities have expanded dramatically.

Cursor is a fork of Microsoft's Visual Studio Code, the world's most widely used code editor, with 75.9% of developers surveyed by Stack Overflow using it as their primary tool. By building on that proven foundation and adding AI-powered code generation, Cursor attracted over a million daily active users by early 2026 and announced a Series D funding round valuing the company at $29.3 billion. The appeal is straightforward: developers can write less code by hand because AI agents handle more of the work, and smaller engineering teams can ship faster.

What Security Flaws Are Putting Developers at Risk?

On July 15, 2026, security researchers at Adversa AI disclosed a critical vulnerability called DeepJack that allows attackers to silently install malicious code on a developer's machine with a single click. The attack exploits Cursor's deeplink handler, a feature designed to let developers quickly install MCP (Model Context Protocol) servers, which are tools that extend Cursor's capabilities by connecting to external services like Jira, Slack, and databases.

The vulnerability works in two ways. The first variant hides a malicious command after a legitimate-looking server name, then pads it with whitespace to push the harmful part off the right edge of the visible dialog box. A developer sees what looks like a clean installation request and clicks approve, never realizing what they are actually authorizing. The second variant disguises an MCP installation link as a pull request review URL using double-URL encoding, so clicking what appears to be a code review link actually installs an attacker-controlled server.

This is not a temporary code execution vulnerability. An attacker-controlled MCP server runs with full user privileges and persists across restarts, giving an attacker durable access to:

• SSH Keys: Stored in ~/.ssh/, enabling lateral movement to every server a developer can reach
• Cloud Credentials: AWS, Google Cloud Platform, and Azure tokens that control infrastructure and billing
• GitHub Tokens and Source Code: Access to private repositories and the ability to push malicious code
• LLM API Keys: Billing accounts for language model services and the ability to run expensive inference at the victim's expense
• MCP-Connected Services: Direct access to every tool connected through Cursor, including internal APIs and databases

Why Did Cursor Take Three Months to Disclose This?

Cursor confirmed the root cause of the vulnerability internally on April 27, 2026, but did not ship a partial fix until July 13, nearly three months later. No CVE (Common Vulnerabilities and Exposures) identifier was filed, no security advisory was published, and no user notification went out. Adversa AI published their full technical disclosure on July 15, and as of build 3.9.8, the vulnerability still works.

The underlying weaknesses are classified as CWE-88 (argument injection) and CWE-939 (improper authorization for critical function), meaning Cursor's deeplink handler does not properly validate or authorize what commands are being executed. This is not an isolated bug; it is part of a systemic problem with how MCP itself was designed. The Cloud Security Alliance documented in April 2026 that MCP's core architecture executes operating system commands passed through configuration parameters without validation, and Anthropic, the company behind Claude and the MCP protocol, confirmed this behavior is intentional and declined to modify the protocol architecture.

How Widespread Is This Problem?

As of mid-2026, there are over 40 documented CVEs across MCP implementations, affecting not just Cursor but also LiteLLM, LibreChat, Windsurf, and MCP Inspector. DeepJack is the predictable consequence of deploying a protocol built without authentication, authorization, or input validation to hundreds of thousands of developers. The previous attack, called CursorJack (CVE-2025-54133), exploited the same deeplink endpoint directly, and Cursor's attempted fix, which surfaced the full command in the install dialog, proved insufficient because attackers simply found new ways to hide malicious code.

The GitHub Security Advisory GHSA-4575-fh42-7848 is tracking this fix, and security researchers are urging developers not to wait for Cursor to ship another patch without a public advisory.

Steps to Protect Your Machine From MCP Backdoor Attacks

• Audit Your MCP Servers: Run the command "cat ~/.cursor/mcp.json" and verify that every entry is something you knowingly installed yourself, not an unexpected server that may have been silently added
• Update Cursor Immediately: Go to Help > Check for Updates and install any available build newer than 3.9.8, though be aware that even the latest version may not fully close all attack vectors
• Enable MCP Tool Protection: Turn on MCP Tool Protection in Cursor Settings if you have not already done so, which adds an additional layer of approval before MCP servers can execute commands
• Never Click Cursor Links From Untrusted Sources: Do not click cursor:// links in emails, Slack messages, GitHub comments, or anywhere else unless you can independently verify the source by contacting the sender directly
• Enterprise Teams Should Enforce Allowlists: Disallow project-local MCP servers via managed configuration and maintain an allowlist of vetted servers, which closes the entire class of deeplink-based MCP install attacks

The tension between Cursor's explosive growth and its security posture reflects a broader challenge in the AI developer tools space: the pace of adoption has outrun the pace of security hardening. Until Anthropic ships authentication primitives into the MCP specification itself, every IDE that implements MCP install-via-deeplink is carrying this risk. For Cursor users, the action item is immediate: audit, update, and stop trusting links you did not initiate.