Malicious MCP servers and Auto-Run
Both 2025 RCE bugs abused MCP config trust. Update to Cursor 1.3 or later, review every MCP server before you add it, and keep Auto-Run off in workspaces you don't fully trust.
// Cursor security
Is Cursor safe? The editor mostly is. Your app is the risk.
Cursor itself is in decent shape: it's SOC 2 Type II certified, Privacy Mode keeps your code out of training, and the two serious 2025 MCP flaws are patched. The part nobody audits is the code Cursor writes for you — that's where the leaks are.
Scan your Cursor app now — free, ~60 seconds, no signup.
Ask whether Cursor is safe and the honest answer is that the tool holds up. Anysphere, the company behind it, is SOC 2 Type II certified. Privacy Mode sends your requests through replicas with logging off and keeps zero-data-retention agreements with OpenAI and Anthropic, so your code isn't stored or trained on. Two genuine remote-code-execution bugs did surface in mid-2025 — CurXecute (CVE-2025-54135, CVSS 8.6) and MCPoison (CVE-2025-54136, CVSS 7.2), both abusing how Cursor trusted MCP server configs — and both were fixed in Cursor 1.3. Stay updated and that class of bug is closed.
The certification covers Cursor's own servers. It says nothing about the app you just built with it, and that's the gap. Cursor writes code fast, and fast code repeats the same mistakes: an API key pasted straight into a file, an endpoint that trusts whatever it receives, auth that confirms you're logged in but never checks the record is yours. Those ship to production and sit there until someone finds them.
A Cursor app can deploy anywhere — Vercel, Netlify, a VPS, with Supabase or Firebase behind it — so the check that matters runs against the live URL, not the editor. Point bleek.dev at your deployed app and it reports what's actually exposed.
2 RCE flaws
critical MCP vulnerabilities in 2025 — CurXecute (CVSS 8.6) and MCPoison (7.2), both patched in Cursor 1.3
Tenable / Check Point Research
SOC 2 Type II
Cursor's compliance level — covers its own infrastructure, not the code you write with it
cursor.com/security
2,000+
critical vulns across 5,600+ AI-built apps audited
Escape.tech
What goes wrong on Cursor
Hard-coded secrets
AI assistants inline API keys and connection strings to make code run. We scan your deployed app for exposed keys in the common formats.
Missing input validation
Generated endpoints tend to trust their inputs, which opens the door to injection. Our deep scan sends safe probes for SQLi and XSS patterns.
Broken access control
Auth that checks 'is logged in' but not 'owns this resource' lets any user read others' data (IDOR). We surface the exposure; a human audit confirms it.
Vulnerable dependencies
AI-suggested package versions are often outdated. We check your front-end libraries against known CVEs.
Your Cursor security checklist
- Run Cursor 1.3 or later — the release that patched the MCP RCE flaws
- Turn on Privacy Mode so your code isn't logged or used for training
- Vet every MCP server and extension before installing; keep Auto-Run off for untrusted code
- No secrets in source — move keys to environment variables
- Validate and parameterise every input
- Access control checks ownership, not just login
- Dependencies updated past known CVEs
- Backend (Supabase/Firebase) rules locked down
Cursor security FAQ
Is Cursor safe to use?
Yes, with normal caution. The editor is SOC 2 Type II certified and Privacy Mode keeps your code private. The two serious 2025 vulnerabilities, CurXecute and MCPoison, are patched in version 1.3, so stay updated. The larger risk isn't Cursor — it's the insecure code it can generate, which you should scan before shipping.
Is Cursor safe for enterprise use?
Cursor's enterprise tier adds SOC 2 Type II, SSO, and Privacy Mode enforced across the org. That covers Cursor's own systems. It doesn't cover the code your team writes or the MCP servers they install, so pair it with code review and a scanning step.
What security vulnerabilities has Cursor had?
The notable ones are CVE-2025-54135 (CurXecute, CVSS 8.6) and CVE-2025-54136 (MCPoison, CVSS 7.2), disclosed in mid-2025. Both let a malicious MCP configuration run code on your machine, and both were fixed in Cursor 1.3. Running an up-to-date version closes them.
How do I make Cursor more secure?
Update to 1.3 or later, turn on Privacy Mode, vet every MCP server and extension before installing, and keep Auto-Run off for code you don't trust. Then scan the app you built for exposed secrets and missing controls.
Is the code Cursor writes secure?
Cursor writes working code, not reviewed code. Hard-coded secrets, missing validation, and broken access control are the usual gaps. Scan and review before it reaches real users.
Should I scan the editor or my app?
Your deployed app. The vulnerabilities live in the running code and its backend, not the editor. Paste your URL into bleek.dev's free scan for exposed secrets, missing headers, and open backends — and enable Deep Scan for active injection and auth-bypass probes.
Find your Cursor app's leaks now.
Free scan, real findings, a copy-paste fix for each one. No signup.