Security researchers have disclosed two critical vulnerabilities in Cursor IDE — CVE-2025-54135 and CVE-2025-54136 — that enabled zero-click remote code execution through manipulated MCP (Model Context Protocol) configuration files, allowing attackers to hijack developer machines without any user interaction beyond opening a project, as documented by Lakera and NSFOCUS.
The Attack Chain
The vulnerabilities exploit a fundamental trust assumption in AI-powered IDE environments. CVE-2025-54136 involves a case-sensitivity bug in Cursor's protected file path validation: attackers could bypass restrictions on configuration files by varying the capitalization of the path, causing the IDE to load a tampered mcp.json file as "trusted." Once the agent read the manipulated configuration, it followed hidden instructions that escalated into arbitrary code execution.
CVE-2025-54135 demonstrates a related vector: a malicious MCP server could inject instructions through tool descriptions that caused Cursor's AI agent to execute Python payloads, harvest secrets including SSH keys and API tokens, and exfiltrate them — all triggered automatically when a developer opened a project containing the crafted configuration.
A Broader Pattern: Living Off AI
These Cursor vulnerabilities are part of a broader class of attacks that researchers are calling "Living off AI" — leveraging legitimate agentic AI workflows for malicious purposes, analogous to the established "Living off the Land" technique in traditional cybersecurity. In a related disclosure, researchers at Lakera demonstrated how a seemingly harmless Google Docs file could trigger an agent inside an AI-powered IDE to fetch attacker-authored instructions from an MCP server, execute payloads, and harvest credentials — without any user interaction.
Separately, Invariant Labs revealed that attackers could embed malicious commands within public GitHub Issues that, when processed by the GitHub MCP server, hijacked AI assistants into exfiltrating private repository data including source code, project details, and personal financial information into public pull requests.
Developers using AI-powered IDEs should restrict MCP server configurations to vetted registries, implement file integrity monitoring for all configuration files, enforce sandboxed execution environments for AI agent operations, and audit all MCP tool descriptions for embedded prompt injection payloads.