Cursor IDE Auto-Run Sandbox Escape via Python Executable Substitution

Technical Analysis

Cursor's Auto-Run Sandbox mode is meant to constrain code/commands an AI agent executes autonomously, limiting file and system access. The flaw arises because the agent, while sandboxed, can write/replace the Python executable inside a project's virtual environment (venv). The Microsoft Python extension, when later activating or interacting with that venv, invokes the substituted executable from outside the sandbox boundary, effectively laundering attacker/agent-controlled code into an unrestricted execution context. This crosses the trust boundary between the sandboxed agent environment and the host IDE process, granting the agent (or anything that has hijacked the agent's actions, e.g., via prompt injection) arbitrary command execution with the user's privileges, including file modification outside the workspace and launching arbitrary applications. The root cause is an incomplete isolation model where sandbox enforcement doesn't extend to files later trusted and executed by a separate, non-sandboxed extension.

Affected Systems

Cursor IDE, Microsoft Python extension for VS Code

Detection Signatures

• Unexpected modification timestamps on venv python/python3 binaries or symlinks
• Python executable in project .venv/bin or venv/Scripts with unusual size, permissions, or non-standard binary signature
• Microsoft Python extension launching processes with command-line arguments inconsistent with normal interpreter invocation
• File writes to venv interpreter paths originating from Cursor agent auto-run sandbox logs
• Host-level process execution correlated with prior sandboxed agent activity referencing venv paths

Remediation Steps

1. 1

   Upgrade Cursor IDE

   Update to Cursor 3.1.2 or later, which fixes this sandbox escape vulnerability.

2. 2

   Restrict venv write access

   Configure or audit sandbox policies so agents cannot write to virtual environment executable paths, even within an ostensibly sandboxed workspace.

3. 3

   Validate interpreter integrity

   Have the Python extension or IDE verify the integrity/provenance of the Python interpreter binary before invoking it outside the sandbox.

4. 4

   Isolate extension execution context

   Ensure extensions like the Microsoft Python extension inherit or respect the same sandbox constraints as the agent that created the environment, rather than executing with full host privileges.

5. 5

   Monitor auto-run agent file writes

   Log and alert on any agent-initiated file writes to interpreter or executable paths within project directories.