Researchers warn that vulnerabilities in AI coding tools themselves may pose a major security risk to developers and enterprises.
The latest example involves Cursor AI, one of the fastest-growing AI-powered code editors. Researchers at Adversa AI found that attackers could abuse Cursor’s handling of deep links and Model Context Protocol servers to trick developers into installing malicious MCP servers on their machines.
The attack is concerning because MCP servers are executable tools that often run with the same privileges as the user who installs them.
In practice, that means a malicious MCP server could become a powerful backdoor inside a developer workstation.
Why MCP Servers Matter
Model Context Protocol, or MCP, is designed to connect AI assistants to external tools and data sources.
MCP servers can help AI coding agents interact with APIs, filesystems, developer tools, repositories, and other services. Used properly, they make AI agents more useful and capable.
But that power also creates risk.
An MCP server is not just a configuration file. It can execute code. If installed maliciously, it may allow attackers to run commands, access files, steal secrets, or interact with development environments.
For developers working inside enterprise networks, that can turn a compromised workstation into a path toward source code, credentials, cloud tokens, internal systems, or customer data.
The Two-Click Attack Path
Adversa AI’s research focused on getting a malicious MCP server installed inside a victim’s Cursor IDE.
The attack used a deep link designed to trigger Cursor’s MCP installation flow.
Because a visible mcp/install link would look suspicious, the researchers concealed the installation instruction inside something developers are more likely to click: a pull request link.
By using double URL encoding, the malicious MCP installation deep link could be hidden inside what appeared to be a normal development workflow.
To the victim, the link could look like a routine pull request.
Behind the scenes, it would trigger an MCP server installation prompt inside Cursor.
Consent Prompt Is Not Enough
The victim still has to approve the installation.
That sounds like strong protection, but the researchers argue that the prompt is not sufficient.
Cursor shows a confirmation dialog asking whether the user wants to install the MCP server. However, the dangerous command arguments may be hidden offscreen because the dialog only displays a limited portion of the argument field.
That means the visible part can look harmless while the malicious command remains out of view.
This creates a dangerous gap between what the developer thinks they are approving and what actually runs.
The issue is not only the existence of a prompt. The issue is whether the prompt gives the user enough accurate information to make a safe decision.
Why Developers May Click Through
The social engineering angle is realistic.
Developers often receive pull requests, setup links, repository onboarding steps, tooling instructions, and configuration prompts as part of normal work.
In modern AI-assisted development, installing an MCP server may also seem plausible. Cursor actively supports MCP installation via links, so the flow itself does not automatically feel suspicious.
That makes the attack more dangerous.
It blends into a workflow developers already understand and trust.
A malicious link, a confirmation dialog, a configuration change, and an MCP install may each look reasonable on their own. The real danger is the chain.
Why This Is Bigger Than Cursor
The Cursor issue reflects a broader pattern.
AI coding tools are rapidly adding powerful agentic features, tool integrations, deep links, automation hooks, and external execution paths.
That makes them attractive targets.
The same kind of design risks have appeared before in other software categories: argument injection, unsafe protocol handlers, weak confirmation dialogs, and excessive trust in user-approved actions.
The difference now is that AI coding environments sit directly inside sensitive development workflows.
They may have access to:
- source code
- local files
- secrets
- API keys
- SSH keys
- Git repositories
- cloud credentials
- internal documentation
- build systems
- production-adjacent tooling
A compromise inside a developer IDE can have a much wider impact than a compromise inside a normal desktop application.
MCP Servers Can Become Backdoors
A malicious MCP server can be especially powerful because it is designed to give an AI agent access to external capabilities.
Depending on its permissions and environment, it may be able to:
- run commands
- read local files
- access repositories
- exfiltrate secrets
- interact with APIs
- modify project code
- install additional tooling
- persist inside the developer workflow
That makes malicious MCP installation a serious supply-chain and endpoint-security concern.
In the wrong hands, MCP turns from an AI productivity feature into an attacker-controlled execution layer.
Cursor’s Response
According to the report, Adversa AI filed two bug reports with Cursor: one covering the argument injection-style issue and another covering the inadequacy of the installation dialog.
Cursor reportedly said the bug had been submitted to a third-party security vendor and was initially closed in error. The company has since reopened the issue and is investigating.
That response highlights another important point: AI tool vendors need mature vulnerability handling processes because their products are becoming part of enterprise development infrastructure.
What Organizations Should Do
Companies using Cursor or other AI coding tools should review how MCP servers are installed and governed.
Recommended actions include:
- allowlist approved MCP servers only
- block or filter untrusted MCP install links
- restrict protocol handlers where possible
- review existing MCP configurations
- monitor for new MCP server installation events
- inspect MCP server command arguments
- prevent unapproved execution from developer tools
- isolate development environments from sensitive systems
- rotate secrets if suspicious MCP activity is detected
- train developers to treat MCP install prompts as high-risk
Security teams should also treat AI coding tools as part of the endpoint attack surface, not just productivity software.
The Need for Agent-Aware Security
Traditional controls often inspect individual events.
A link click.
A dialog prompt.
A config file change.
A tool execution.
An MCP request.
But agentic workflows create risk across the full sequence.
The important question is not only whether one step looks suspicious. It is whether the final action matches what the user actually intended and approved.
Future security controls will need to understand the full chain of agentic activity, including MCP traffic, tool calls, prompts, approvals, and execution context.
That is a harder problem than blocking a single malicious file or a single suspicious command.
Final Thoughts
The Cursor AI research shows that AI coding security is not only about unsafe code suggestions or prompt injection.
The tools themselves are becoming powerful execution environments.
MCP servers give AI agents real capabilities. Deep links make installation convenient. Developer workflows make clicks feel routine. Weak consent prompts can hide dangerous details.
Together, those ingredients create a new attack surface.
AI coding tools need the same defense-in-depth that browsers, operating systems, and package ecosystems spent years building. A prompt is not enough. Organizations need allowlists, sandboxing, visibility, policy enforcement, and agent-aware monitoring before powerful AI development tools become another route into the enterprise.
