CurXecute (CVE-2025-54135): How a Slack Message Made Cursor's AI Agent Rewrite Its Own Config and Run Code
Key takeaways
- →Aim Labs found that Cursor's agent could create a new entry in the MCP configuration file without approval, and Cursor started it immediately.
- →A prompt injected through a public Slack message, read via the Slack MCP server, made the agent write a malicious MCP entry. The result was remote code execution with developer privileges.
- →AgentGuard treats an agent rewriting its own tool configuration as a privileged act outside the task, and blocks it before anything runs.
- 1
Attacker posts crafted message in a public Slack channel
- 2
Developer asks Cursor's agent to summarize Slack
- 3
Injected text tells the agent to edit mcp.json
AgentGuard blocks the agent from writing to its own tool configuration out of task context
- 4
New MCP server entry auto-starts attacker command
- 5
Code runs on developer workstation
- Affected
- Cursor IDE users before version 1.3 (patched)
- When
- Fixed July 29, 2025 · disclosed August 1, 2025
- Impact
- Remote code execution on developer machines with the user's privileges
What happened
Cursor, an AI code editor used by a large share of professional developers, lets its agent connect to external tools through the Model Context Protocol (MCP). Aim Labs found that while editing an existing MCP config needed user approval, creating a new mcp.json entry did not, and Cursor launched the new server immediately.
In the attack, a malicious message sat in a public Slack channel. A developer with the Slack MCP server connected asked Cursor to summarize recent messages. The injected text told the agent to add an MCP server whose start command was an attacker payload. The agent wrote the file, and Cursor executed the command, before the developer could react.
The flaw was tracked as CVE-2025-54135 with a CVSS score of 8.6. Cursor fixed it in version 1.3, released July 29, 2025.
Why nothing caught it
Developer workstations hold source code, cloud credentials, SSH keys and CI tokens, which makes them some of the most valuable machines a company has. Here the payload ran as a child of a trusted, signed application, launched by a configuration change that the application itself made. Nothing looked like an intrusion.
- EDR saw the IDE spawning a process, which it does all day
- Slack content passed every link and attachment scan
- No credential was phished or stolen up front
- The developer's only action was asking for a summary
How AgentGuard would have stopped it
AgentGuard models each agent's current task and its Principal chain: who asked, through which tool, and with what authority. The developer asked for a summary. Writing executable entries into the agent's own tool configuration has no connection to that task, and the instruction came from untrusted Slack content, not from the developer.
AgentGuard classifies self-modification of agent tooling (MCP configs, rules files, extension settings) as a privileged action. It requires human-originated intent, so the write is blocked at step three and the payload never launches. AgentGuard also inventories every MCP server and agent across the fleet, so security teams see when a new tool appears anywhere.
What to do Monday
AI coding agents are now part of your software supply chain.
- Update Cursor and every AI IDE to current versions
- Inventory MCP servers connected on developer machines
- Treat agent config files as protected, monitored assets
- Separate untrusted-content tools from code-execution tools
The lesson
Each of these attacks used an AI system that was doing exactly what it was allowed to do, on behalf of someone it should never have obeyed. Patches close one path at a time. AgentGuard closes the class: it judges every agent action against the agent's task, its Principal and its environment, with zero integration and deployment measured in days.
Frequently asked questions
What is CurXecute?
CurXecute is CVE-2025-54135 (CVSS 8.6), a vulnerability in the Cursor AI code editor discovered by Aim Labs. Prompt injection could make Cursor's agent create a new MCP server entry that executed attacker commands without user approval. It was fixed in Cursor 1.3.
Why is MCP configuration a security boundary?
An MCP config decides which tools and commands an AI agent can run. An agent that can rewrite its own config can grant itself code execution, so changes to it must require verified human intent.
How does AgentGuard prevent agent self-modification attacks?
AgentGuard checks every agent action against the agent's current task and the origin of its instructions. Writes to agent tooling that come from untrusted content and fall outside the task are blocked before they run.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.