Cursor AI Extension Vulnerabilities Expose Developer Credentials and Enable Code Execution
Researchers discovered high-severity vulnerabilities in the Cursor AI coding environment that allow malicious extensions to access stored developer credentials and execute arbitrary code on developers' machines. Cursor's use of unprotected local storage for API keys and session tokens without access controls enables attackers to extract sensitive data and compromise developer environments.
What happened
Cursor stores authentication data including API keys and session tokens in a local SQLite database without protection from operating system keychains or access controls, according to LayerX research. Any installed extension can directly query this database regardless of the permissions it requests, allowing extraction of credentials without user interaction or visible alerts.
Researchers demonstrated that a malicious extension disguised as a harmless tool could gain code execution within Cursor, immediately access local credential storage, and silently exfiltrate sensitive data. Cursor reportedly acknowledged the notice but stated that defining trust boundaries is the user's responsibility. The issue remained unresolved as of April 28, 2026.
Reported impact
Stolen API keys can be used to access third-party platforms such as OpenAI, Anthropic or Google services, creating downstream risks including unauthorized API usage leading to financial loss, exposure of prompts and outputs, and potential misuse of services for further attacks.
LayerX assigned the flaw a CVSS score of 8.2, warning that it could enable full credential compromise across a developer's environment.
Index analysis
The vulnerability stems from Cursor's design choice to store secrets locally without standard security mechanisms and without enforcing access controls between extensions and storage. The absence of permission prompts or warnings increases the risk to developers who install extensions from marketplaces.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.