Research demo
Context poisoning through an MCP web-scraper tool leads Cursor to run credential-exfiltrating shell commands
AIR-2025-0048 AIR record · 2025-06-cursor-mcp-scraper-context-poisoning
From the supporting source
The idea was that when the MCP tool scraped the site it would incidentally feed the “prompt” to the Cursor LLM and “poison” its context. As a result, it would trick Cursor into executing the malicious command and sending a users’ sensitive data to a remote server.backslash.security
The record
Disclosed
2025-06-24
Vendor
Anysphere
Product
Cursor
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Confused deputy
System type
Generative model
Who acted
Agent acted — Cursor ran the credential-exfiltrating shell commands
Attack surface
MCP server
Autonomy level
Copilot with approval
Initial vector
Indirect prompt injection web page
Impact type
Credential theft, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Cursor users who connect an untrusted MCP server that returns web content
Capability abused
Defense & remediation
Recorded defense
Cursor's command-approval prompt
Guardrail kinds
Human approval
Guardrail outcome
Silent
Taxonomy & references
Curator notes
Backslash Security. Cursor still prompts the user before executing, so the approval gate is the only remaining control.
Supporting sources
Cite as
Enkrypt AI. "Context poisoning through an MCP web-scraper tool leads Cursor to run credential-exfiltrating shell commands". AIR, AIR-2025-0048. https://agentincident.vercel.app/i/AIR-2025-0048/ (accessed 2026-10-19).