Popular AI Coding Assistant Cursor Faces Critical Security Risk from Hidden Prompt Injection Attacks

The widely-used AI programming tool Cursor has been flagged with a significant vulnerability that could leave developers and the companies relying on it at considerable risk. Cybersecurity researchers at HiddenLayer revealed what they term a “CopyPasta License Attack”—a sophisticated method where attackers embed malicious instructions in project documentation files like LICENSE.txt and README.md, potentially compromising codebases without detection.

How the Attack Works

The vulnerability exploits how AI tools process Markdown comments and project metadata. By concealing prompt injections in license and readme files, hackers can manipulate the AI into automatically spreading harmful code whenever a developer uses Cursor to edit or generate files. The tool processes these hidden instructions as legitimate commands, creating a direct pathway for malicious payloads to infiltrate development environments.

During security testing, researchers demonstrated that when Cursor processes a repository containing the virus, it automatically replicates the embedded prompt injection into newly created files—essentially weaponizing the AI assistant’s productivity features into a distribution mechanism for exploits.

Widespread Vulnerability Across Multiple Tools

Cursor isn’t alone in this risk category. Security tests revealed similar vulnerabilities affecting other AI programming assistants including Windsurf, Kiro, and Aider, indicating this is a systemic issue across the AI-assisted development tool ecosystem.

Potential Impact and Consequences

The implications are severe. Malicious code injected through these vectors can establish backdoors, exfiltrate sensitive data, or disable critical systems entirely. The attacks are particularly dangerous because the malicious payloads can be deeply embedded and obfuscated, making detection extraordinarily difficult during code review processes.

The risk escalates significantly in enterprise environments where development teams work on production systems. A compromised codebase could cascade through deployment pipelines, affecting live services and sensitive infrastructure. Financial and technology companies that rely heavily on these AI tools face elevated exposure to supply chain attacks through their development workflows.

Industry Adoption Context

The vulnerability disclosure comes at a time when Cursor has achieved rapid adoption as a preferred development tool among major technology organizations. This widespread deployment means the security flaw potentially affects a large developer community and the platforms they build.

HiddenLayer’s warning emphasizes that this attack mechanism could have cascading consequences across both development and production environments, making immediate awareness and mitigation essential for any organization leveraging AI programming assistants in their development stack.