The shift toward AI-assisted software engineering has introduced a massive shift in developer productivity, but it has also carved out entirely new vectors for cyberattacks. A stark reminder of this reality arrived following security research revealing that Cursor AI, a highly popular AI-native code editor used by over 64% of the Fortune 500, is susceptible to a dangerous “two-click” exploit.

Discovered by security researchers at Adversa AI and running parallel to deep-link flaws (often tracked under concepts like “CursorJack”), this exploit allows a remote attacker to silently compromise a developer’s workstation. The payload? A permission-rich Model Context Protocol (MCP) server that grants the attacker unrestricted, sandboxed-free access to the local machine.

Here is a breakdown of how the exploit functions, why development environments are the ultimate prize for modern threat actors, and how to defend against it.

The Core Threat Vector: Model Context Protocol (MCP)

To understand the severity of the exploit, one must understand the power of MCP. Built to connect AI models seamlessly to the local environment, MCP allows an AI agent to query databases, call external APIs, and execute local file-system operations.

However, in development tools like Cursor, MCP servers typically execute commands with the exact same privileges as the user who installed them. While this grants the AI the fluid access it needs to code efficiently, it also means a malicious MCP server acts as a stealthy, hyper-privileged backdoor.

Anatomy of the “Two-Click” Takeover

The attack chain relies on an old-school combination of UI obfuscation, social engineering, and deep-linking. It unfolds in three primary stages:

1. The Poisoned Pull Request (Click #1)

Because developers are trained not to click random configuration or installation links out of the blue, attackers weaponize routine code review habits. Researchers discovered they could use double URL encoding to conceal a Cursor installation deep-link (cursor://...) inside what appears to be a standard GitHub or GitLab Pull Request link.

When a developer clicks the link to review their colleague’s code, the browser intercepts the custom protocol handler and seamlessly opens the Cursor IDE.

2. The Truncated Dialog Box (Click #2)

Once inside the IDE, Cursor displays a pop-up confirmation dialog asking the user if they wish to install an MCP server.

This is where a classic user interface flaw comes into play. The confirmation window shows the name of the server, but the “Argument” field—the section displaying the exact commands the server will run—is horizontally constrained. An attacker can easily format the line so that a legitimate-looking string of code is visible, while hiding a string of malicious commands completely off-screen.

Believing they are simply accepting a repository-specific tool, the developer clicks “Install”.

3. Execution & Persistence

The moment the developer hits approve, the malicious configuration is written to the editor’s local settings (such as ~/.cursor/mcp.json). The attacker’s remote server immediately drops a payload—often establishing an active Meterpreter or command-and-control (C2) session. Because MCP processes run persistently alongside the editor, the malicious code can execute every single time Cursor is launched, entirely bypassing any internal application sandboxing.

Why Developers are High-Value Targets

Securing the developer workstation has traditionally been an afterthought compared to locking down production servers, but the explosion of AI coding tools has dramatically shifted the risk landscape. Compromising a developer’s machine yields an immediate treasure trove:

• High-Value Credentials: Access tokens, cloud provider keys (AWS, Azure), and SSH keys used to push code.

• Proprietary IP: Full access to local Git repositories, uncommitted source code, and underlying corporate architecture.

• Supply Chain Amplification: A compromised developer profile allows attackers to quietly inject malicious snippets into version control or CI/CD pipelines, poisoning production software before it ever reaches deployment.

How to Protect Your Environment

Securing AI-assisted development setups requires moving past the assumption that local IDE extensions are inherently safe.