4 ms·
The entire point of Cursor is to run autonomous coding agents. You are giving it a random untrusted repo, saying "hey it might have a virus, go crazy" and then
by paxys 4mo ago
The entire point of Cursor is to run autonomous coding agents. You are giving it a random untrusted repo, saying "hey it might have a virus, go crazy" and then getting mad that it caused harm?
Check (and double check and triple check) your sources. If a malicious executable made it to your computer it is already too late.
- shitter 4mo ago? Doesn’t the code exec happen upon merely launching Cursor against a repository, without giving an agent any tasks? That’s clearly an issue at the Cursor application level, not some inevitable risk caused by the non-deterministic nature of LLMs. You can’t use the latter fact to excuse the former mistake Not to mention that Cursor has an agent permissions model that this presumably sidesteps!
- cute_boi 4mo agoI agree cursor can fix the issue, but the main issue is downloading anything from untrusted source. The repo may have AGENTS.md which can tell please install npm package from random repo and run pnpm start etc... We should never ever download any pdf or excel macros etc.. from untrusted source.
- iainmerrick 4mo agoIf you can’t download anything safely, the web can’t exist.
- hnfong 4mo agoIf we take your logic to the extreme, then there are never any legitimate code execution vulnerabilities in web browsers since the user is not supposed to visit untrusted websites.
- cute_boi 3mo agoCorrect, we shouldn't visit untrusted website unless it is from trusted source like banks etc.. There is reason why scamming is billion dollar industry.
- thewhitetulip 4mo agoCursor is used for vibe coding. There are people who used Cursor to build a webapp where passwords are printed on the front page So yeah, this is a major issue
- brookst 4mo agoDifferent layers, different risks. You do not expect an agent-level app to run untrusted binaries. You expect prompt injection, etc. And I don't at all agree that a malicious executable landing in some directory is already game over. Plenty of zip files have malicious executables, it doesn't mean you say "oh, my zip extractor should just run every executable because if one's bad I'm already toast".
- xeyownt 4mo agoOk, so you download the repo, launch Cursor, it compiles code and run it (if not, why do you even use Cursor at the first place?). Same effect.