Disclosed vulnerability
NomShub: malicious repo chains prompt injection, shell-builtin sandbox escape and Cursor's remote tunnel into a persistent shell
AIR-2026-0086 AIR record · 2026-04-straiker-nomshub-cursor
From the supporting source
is completely blind to shell builtins-commands that are executed by the shell itself rather than as separate processesstraiker.ai
The record
Disclosed
2026-04-03
Occurred
2026-01-16
Vendor
Anysphere
Product
Cursor on macOS (VS Code code-tunnel binary also affected)
Risk domain
Access control and permissions › Privilege escalation
Also touches
Supply chain vulnerabilities, Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — Cursor executed the chain and opened a persistent remote tunnel
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection repository content
Impact type
Remote code execution, Persistent backdoor, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
macOS developers opening a malicious repository in Cursor
Capability abused
Defense & remediation
Recorded defense
Cursor's shouldBlockShellCommand IDE-level command parser and workspace sandbox
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
Cursor 3.0, released 2026-04-02
Taxonomy & references
Curator notes
Authors Karpagarajan Vikkii and Amanda Rousseau (Straiker STAR Labs). Discovered 2026-01-16, reported 2026-02-02, acknowledged 2026-04-01, patched 2026-04-02. No CVE listed. Exfiltrated GitHub device code routes the reverse shell through Microsoft Azure tunnel infrastructure. Quote's em-dash normalized to a hyphen.
Cite as
Enkrypt AI. "NomShub: malicious repo chains prompt injection, shell-builtin sandbox escape and Cursor's remote tunnel into a persistent shell". AIR, AIR-2026-0086. https://agentincident.vercel.app/i/AIR-2026-0086/ (accessed 2026-10-19).