Cursor AI Coding Tool Vulnerable to Prompt Injection Attack
Cybersecurity firm HiddenLayer reported that Cursor, an AI coding tool widely used by Coinbase and others, is vulnerable to a "CopyPasta License Attack" that can inject malicious prompts into code repositories through hidden comments in common developer files. The attack could potentially allow hackers to spread malware, exfiltrate data, or disrupt development environments across an organization.
What happened
Cybersecurity firm HiddenLayer reported on September 5, 2025, that Cursor and other AI coding tools (Windsurf, Kiro, and Aider) are vulnerable to a "CopyPasta License Attack" that can inject malicious prompts into code repositories.
The attack hides prompt injections in common developer files such as LICENSE.txt and README.md files within markdown comments, allowing the injected instructions to direct AI coding tools without user knowledge and spread across entire codebases.
Reported impact
HiddenLayer warned that injected code could stage a backdoor, silently exfiltrate sensitive data, introduce resource-draining operations that cripple systems, or manipulate critical files to disrupt development and production environments, all while remaining buried inside files to avoid immediate detection.
Index analysis
Coinbase's engineering team had identified Cursor as the preferred tool for most of its developers and stated it had been used by every Coinbase engineer by February 2025, making the company and others using these tools potentially vulnerable to the attack.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.