Bash expansion attacks by agents - applicability to Cursor?

This is a timely piece of research about a class of agentic attacks the authors have dubbed GuardFail, in which agents process seemingly innocuous bash shell commands that are expanded, unquoted or rewritten into malicious commands, evading surface level defenses:

Cursor is not named in the article, but a number of other AI coding tools such as Aider and Cline are. I’m curious whether Cursor has implemented any controls to defeat this threat vector? The tools listed had varying levels of defenses ranging from none at all to full defeat of all bypass threats.

As an MCP developer, I’m looking closely at how to mitigate this threat to downstream agents by checking captured and emitted data before it reaches the agent/bash execution boundary.

Hi @rsb!

Running commands in a Sandbox, combined with Auto-Review Run Mode, which evaluates commands before execution and prompts for approval when they’re deemed risky, should provide some protection against dangerous shell commands.

While the classifier powering Auto-Review Run Mode isn’t perfect and can occasionally make mistakes, it’s fairly effective at preventing the execution of dangerous commands!

You can read more in the docs here.