Cursor — agentic threat model

Cursor leverages advanced models like GPT-4. Threats include prompt injection attacks that could trick the model into generating insecure code, introducing subtle backdoors, or bypassing safety filters to leak proprietary system prompts.

The agent features 'Repo-Wide Understanding', meaning it indexes and processes the entire local codebase. This creates a high risk of data exfiltration of proprietary IP if the indexing data or vector embeddings are insecurely transmitted or stored.

With features like auto-debugging and lint fixing, the agent orchestrates tool calls to interact with local files and compilers. Insecure tool integration could allow a malicious codebase (via prompt injection in source files) to execute arbitrary commands on the host system.

As a local IDE fork of VSCode, Cursor runs directly on the developer's machine with user-level privileges. Compromise of the client application or its backend API communication channels could lead to full host compromise.

Not certain from the listing — there is no mention of real-time guardrails, logging of model outputs, or drift detection mechanisms to monitor the safety of generated code before it is executed or committed.

The listing highlights 'Privacy Mode' to prevent code from being stored or used for training. However, there is no explicit mention of enterprise compliance standards (like SOC2), role-based access controls, or audit logging for compliance verification.

Cursor maintains VSCode compatibility, allowing it to interact with a vast ecosystem of third-party extensions. This introduces supply-chain risks where compromised extensions could interact with or exploit Cursor's agentic capabilities.