Disclosed vulnerability
MCPoison: Cursor trusted MCP config entries by name, allowing silent post-approval payload swap
AIR-2025-0081 AIR record · 2025-08-cursor-mcpoison
From the supporting source
Once a collaborator accepts a harmless MCP, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-prompt.thehackernews.com
The record
Disclosed
2025-08-05
Vendor
Anysphere
Product
Cursor IDE
Risk domain
Access control and permissions › Privilege escalation
Also touches
Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted — the agent launched the swapped MCP payload after trust was granted
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Malicious repository config file
Impact type
Remote code execution, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Cursor 1.2.4 and below; any shared repository containing a .cursor/mcp.json
Capability abused
Defense & remediation
Recorded defense
one-time user approval of MCP server configurations
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
Cursor 1.3 (late July 2025) - re-approval now required on every MCP config change
Taxonomy & references
Curator notes
Discovered by Check Point Research; CVSS 7.2. Root cause is a trust-on-first-use flaw: trust was bound to the MCP key name, never to the command or its arguments. Check Point's own writeup is not used as the source here; The Hacker News article quoting it was used as the primary source. Also reported as: 'MCPoison (CVE-2025-54136): Cursor re-trusts an approved MCP entry after its command is silently swapped'.
Supporting sources
Cite as
Enkrypt AI. "MCPoison: Cursor trusted MCP config entries by name, allowing silent post-approval payload swap". AIR, AIR-2025-0081. https://agentincident.vercel.app/i/AIR-2025-0081/ (accessed 2026-10-19).