This is a timely piece of research about a class of agentic attacks the authors have dubbed GuardFail, in which agents process seemingly innocuous bash shell commands that are expanded, unquoted or rewritten into malicious commands, evading surface level defenses:
Cursor is not named in the article, but a number of other AI coding tools such as Aider and Cline are. I’m curious whether Cursor has implemented any controls to defeat this threat vector? The tools listed had varying levels of defenses ranging from none at all to full defeat of all bypass threats.
As an MCP developer, I’m looking closely at how to mitigate this threat to downstream agents by checking captured and emitted data before it reaches the agent/bash execution boundary.