Disclosed vulnerability
The agent security paradox: Cursor's implicitly trusted shell built-ins (export, typeset, declare) allow silent environment poisoning to sandbox bypass and RCE
AIR-2026-0012 AIR record · 2026-01-cursor-shell-builtin-env-poisoning
From the supporting source
By abusing implicitly trusted shell built-ins like `export`, `typeset`, and `declare`, threat actors can silently manipulate environment variables.pillar.security
The record
Disclosed
2026-01-14
Vendor
Anysphere (Cursor)
Product
Cursor
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent executed shell built-ins that poisoned its own environment
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Indirect prompt injection to shell builtin abuse
Impact type
Remote code execution, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Cursor users relying on command allowlists
Capability abused
Defense & remediation
Recorded defense
command classification and approval; allowlist of trusted commands
Guardrail kinds
Human approval, Permission scope
Guardrail outcome
Silent
Fix shipped
fixed January 2026 - explicit user approval now required for unclassified commands; Cursor discouraged allowlist reliance
Taxonomy & references
Curator notes
Pillar Security (Dan Lisichkin). Reported 2025-08-11, acknowledged as systemic September 2025, fixed January 2026, CVE-2026-22708. Same structural failure as the Amazon Q and Copilot CLI allowlist bypasses: the classifier reasons about command names, not about what an invocation can actually do.
Supporting sources
Cite as
Enkrypt AI. "The agent security paradox: Cursor's implicitly trusted shell built-ins (export, typeset, declare) allow silent environment poisoning to sandbox bypass and RCE". AIR, AIR-2026-0012. https://agentincident.vercel.app/i/AIR-2026-0012/ (accessed 2026-10-19).