Hi Cursor Team,
I am writing to report a severe and widespread abuse of the Cursor Edu Partner program (which offers 6 months of free Pro+ for students at universities like Stanford, CMU, etc.).
It has come to my attention that a large number of users are actively exploiting loopholes via packet sniffing and parameter manipulation to fraudulently obtain high-tier subscriptions for free. Furthermore, an underground market has already emerged where these bad actors are massively reselling these fraudulently obtained premium accounts at 70% to 80% of your official retail price.
Here are the specific methods currently being used to exploit the system:
1. Email Alias Abuse Some universities allow students to create multiple email aliases for a single account. Bad actors are using this feature to register numerous Cursor accounts under different aliases, hoarding the 6-month free Pro+ benefit to generate inventory for resale.
2. Bypassing Domain Restrictions via Request Manipulation By capturing and modifying network requests during the registration/checkout process, users are bypassing the .edu domain validation. This allows them to apply the educational benefit to completely unrelated, standard email addresses (such as Outlook or Gmail accounts).
3. Stripe Promo Code Misconfiguration (The Most Critical Issue) The promo code applied during the Stripe checkout seems to be configured as an unconditional “100% OFF” discount. Users have realized that by manipulating the subscription type payload during checkout, they can apply this 100% discount to other, much more expensive subscription tiers. For example, people are successfully securing Ultra Annual and Pro+ Annual subscriptions entirely for free.
Below, I have attached several screenshots circulated by these resellers showing successful zero-dollar checkouts for annual plans and their sales advertisements. This exploit has already caused large-scale financial damage.
I highly recommend that your engineering and billing teams immediately take the following actions:
-
Correct the Stripe promo code configuration so it is strictly locked to the specific 6-month monthly Pro+ plan.
-
Implement strict server-side validation for the email domain during the checkout process.
-
Integrate a robust third-party verification service like SheerID (preferably requiring video verification or document uploads) to strictly authenticate genuine student status and stop alias abuse.
-
Audit recent zero-dollar transactions and revoke the illegally acquired subscriptions.
Hope this major loophole gets patched as soon as possible before more damage is done!
Best regards,
Fin Tagg