Cursor Cloud Agent Unauthenticated Local Endpoint Leading to Sandbox Code Execution and Credential Theft

Technical Analysis

The Cloud Agent container ran a local, network-accessible agent management/control endpoint that performed no authentication, operating on the assumption that only trusted internal components could reach it. Because the agent had browser/web-access capability, any attacker-controlled web page rendered or fetched during an agent session could issue requests (a form of SSRF/CSRF-like cross-boundary call) from within the container to that localhost/internal endpoint, effectively crossing the trust boundary between 'external web content' and 'privileged agent control plane.' This granted the attacker the ability to execute arbitrary actions/code within the agent's sandbox context, exfiltrate repo contents, environment secrets, and GitHub App access tokens tied to that session. The root cause is a missing-authentication design flaw on an internal API that was implicitly trusted due to network locality rather than verified identity, compounded by the agent's ability to autonomously fetch/render untrusted external content.

Affected Systems

Cursor Cloud Agent

Detection Signatures

• Unexpected inbound requests to internal Cloud Agent control-plane endpoints originating from browser/rendering subprocesses
• Log entries showing agent-endpoint API calls without corresponding authenticated session tokens
• Outbound requests exfiltrating environment variables, .git credentials, or GitHub App tokens shortly after web-browsing activity in an agent session
• Anomalous local-loopback or container-internal traffic correlated with page loads of untrusted external domains

Remediation Steps

1. 1

   Upgrade Cursor

   Update to the patched Cursor version (post 03/31/2026) that enforces authentication on the Cloud Agent local endpoint.

2. 2

   Enforce authenticated internal APIs

   Require strong per-session authentication/authorization on all local or internal agent control endpoints, never relying on network locality as an implicit trust boundary.

3. 3

   Isolate browsing capability

   Sandbox or proxy agent web-browsing separately from the agent control plane so rendered external content cannot reach internal APIs directly (network segmentation, egress/ingress filtering).

4. 4

   Rotate exposed credentials

   Rotate GitHub App tokens, environment secrets, and any credentials that were present in Cloud Agent sessions active before the patch.

5. 5

   Audit historical sessions

   Review logs for Cloud Agent sessions with browsing enabled prior to the fix date for signs of exploitation or unexpected outbound data transfers.