URGENT: Critical Vulnerability via MCP Permitting "Infinite Tokens" and Limit Bypasses

Discussions
, ,
1

Hello Cursor Team,

I am writing to report a major loophole I’ve discovered in the current build of Cursor. There is a critical vulnerability involving the Model Context Protocol (MCP) integration that allows users to bypass token and context limits entirely.

Vulnerability Description: When a user routes their connection through MCP, it leverages the persistent session and listening capabilities in an unintended way. This creates an indefinite connection that locks Cursor into the current workspace context without ever forcing a refresh, dropping the connection, or applying standard context truncation.

The Impact: Users are essentially able to exploit this as an “infinite token” glitch. Because the context never breaks, users do not have to re-send background prompts or rebuild context for massive projects. While the continuity is great, it completely bypasses your standard usage limits. I imagine this could lead to massive API abuse, token hoarding, and unexpected backend costs for your team, as users can theoretically keep an endless context window open for free.

Summary of Exploit:

  1. Connect and route the development environment through MCP.

  2. Utilize its persistent listening feature to keep the session alive indefinitely.

  3. The user can now process thousands of lines of code and cross-file logic without ever hitting standard token caps or being forced to start a new chat.

I strongly recommend investigating the way Cursor handles context lifecycle and token metering when connected via MCP. This is a massive loophole that could easily be abused by high-frequency developers.

Please let me know if you need more specific configuration details or reproduction steps to help patch this issue.

Best regards,

4

Hi @Karen_Henderson

The claims in this post aren’t accurate. MCP does not bypass token limits or usage metering.

Every model call goes through standard usage accounting regardless of whether MCP is involved. There is also a hard cap on tool calls per conversation and active loop detection for repeating patterns. While an MCP tool runs locally on your machine, no model resources are consumed during that time. As soon as the model is called again, it counts against your plan normally.

This was addressed in a related thread as well.