6 ms·

Hey there! I run DevRel & SecRel @ Snyk, we just published a piece to help dispel all the rumors, etc. This provides a lot of in-depth info on the situation: ht

Hey there! I run DevRel & SecRel @ Snyk, we just published a piece to help dispel all the rumors, etc. This provides a lot of in-depth info on the situation: https://snyk.io/blog/snyk-security-labs-testing-update-cursor-com-ai-code-editor/ https://snyk.io/blog/snyk-security-labs-testing-update-curso... The TL;DR is that our security research team routinely hunts for various vulnerabilities in tools developers use. In this particular case, we looked at a potential dependency confusion attack in Cursor, but found no vulnerabilities. There's no malicious intent or action here, but I can certainly understand how it appears when there's not a ton of information and things like this occur! As a sidenote, I use Cursor all the time and love it <3

rettichschnidi 2y ago
Sorry, but you screwed up royally. Scary to see that Snyk still does not see this. Ethically, your work was even lower than that of those who test their AI tools on FOSS code, send in bogus reports and thus waste maintainer's time. Experimenting on unwitting humans and ecosystems is not okay.
guappa 2y ago
> The packages performed HTTP requests back to our researchers containing username, hostname, current directory and (in later versions) environmental variables. And exfiltration was needed to confirm a vulnerability why exactly? I love how completely unaware you guys are.