You may have seen Mindgard’s report describing a vulnerability in Cursor involving a malicious git.exe binary placed in a repository’s root.
After reviewing this report we determined that it was out of scope for our bug bounty program. We operate under a shared responsibility model for workspace and agent-context inputs. Customers decide which repositories, prompts, external content, MCP servers, rules, and tools to introduce into their environment, and Cursor provides controls to help manage that trust boundary. Issues that depend on compromised or malicious inputs already being present in that context generally fall outside the scope of our bug bounty program. However, we did not close the loop with the researcher in a timely manner, and we take responsibility for that. We are addressing this as a matter of process moving forward.
The practical risk is limited by narrow preconditions: the issue affects Windows only, and only when a user opens a repository or directory that already contains a malicious executable named exactly git.exe in the project root. macOS and Linux are not affected.
For customers that include working with potentially malicious repositories in their threat model, we provide Workspace Trust as a security control. When enabled, untrusted folders open in a restricted mode that prevents malicious repositories from automatically executing code. Organizations can enforce this setting fleet-wide through MDM.