# My antivirus detects cursor-agent as trojan

**URL:** <https://forum.cursor.com/t/my-antivirus-detects-cursor-agent-as-trojan/158513>\
**Category:** Help\
**Tags:** cli, windows, security\
**Created:** [April 20, 2026, 12:35pm UTC](https://forum.cursor.com/t/my-antivirus-detects-cursor-agent-as-trojan/158513 "2026-04-20T12:35:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![klemonade](https://avatars.discourse-cdn.com/v4/letter/k/edb3f5/32.png) [@klemonade](https://forum.cursor.com/u/klemonade)\
**Post date:** [April 20, 2026, 12:35pm UTC](https://forum.cursor.com/t/my-antivirus-detects-cursor-agent-as-trojan/158513/1 "2026-04-20T12:35:01Z")

</div>

I am using Kaspersky and it detected curser-agent as Trojan. These are details  
```  
Event: Malicious object detected  
Application: Node.js JavaScript Runtime  
User: s\upupu  
User type: Active user  
Component: System Watcher  
Result description: Detected  
Type: Trojan  
Name: PDM:Trojan.Win32.Generic  
Threat level: High  
Object type: Process  
Object path: C:\Users\upupu\AppData\Local\cursor-agent\versions\2026.04.17-787b533  
Object name: index.js  
Reason: Behavior analysis  
Databases release date: Today, 20/04/2026 15:07:00  
MD5: 858659C5B8406441EBF0018DCD58DC1F  
```

---

<div class="post-metadata">

**Author:** ![deanrie](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/deanrie/32/1263_2.png) [@deanrie](https://forum.cursor.com/u/deanrie)\
**Post date:** [April 23, 2026, 4:57am UTC](https://forum.cursor.com/t/my-antivirus-detects-cursor-agent-as-trojan/158513/4 "2026-04-23T04:57:28Z")

</div>

Hey, this is a known false positive from Kaspersky. Its PDM Proactive Defense Module is behavior-based heuristic analysis, not signature detection. `cursor-agent` is a Node.js CLI that does what any dev tool does, like outbound API calls, running terminal commands, spawning child processes, and talking to MCP servers. For PDM that can look suspicious, so you get the generic detection `PDM:Trojan.Win32.Generic`.

A few similar threads with the same detection:

- [Kaspersky Flagged Cursor IDE as ClipBanker Trojan on Windows](https://forum.cursor.com/t/kaspersky-flagged-cursor-ide-as-clipbanker-trojan-on-windows/157716)
- [Kaspersky accusing Cursor of being a trojan](https://forum.cursor.com/t/kaspersky-accusing-cursor-of-being-a-trojan/135408)
- [Trojan in Cursor](https://forum.cursor.com/t/trojan-in-cursor/126766)

Workaround: add the full path `C:\Users\upupu\AppData\Local\cursor-agent\` to Kaspersky exclusions, including the `versions` subfolder. It also helps to submit a false positive report directly to Kaspersky so they can update their detections faster: [https://opentip.kaspersky.com/](https://opentip.kaspersky.com/)

If something still gets triggered after the exclusion, tell me and we’ll take a look.