Vulnerability / research

CurseChain carries malicious instructions into a later Cursor task

Reported

What happened

Hidden repository instructions induced Cursor to expose an SSH key and carry malicious generated logic into a subsequent, unrelated project within the same working context.

Parties and reporting

AI tools and systems: Cursor

Outcome

Cursor closed the report as informative; researchers published demonstrations of both automatic execution and execution after user approval.

Operating lesson

Separate unrelated agent contexts and keep development secrets outside agent-readable project environments.

Evidence and limits

Research demonstration, not a confirmed criminal campaign. The finding concerns retained working context, not proven indefinite memory across sessions.

Sources