A critical security vulnerability discovered in Cursor AI, a leading AI-powered code editor, could have enabled attackers to completely compromise developer machines through sophisticated prompt injection techniques. Security researchers at Straiker uncovered this attack chain, designated "NomShub," which demonstrated how malicious actors could exploit AI coding assistants to gain unauthorized system access.

The vulnerability chain represented a new class of AI security threats, combining indirect prompt injection with sandbox bypass techniques and abuse of legitimate application features. Unlike traditional malware attacks, this exploit leveraged Cursor's own functionality against users, making detection extremely challenging through conventional security measures.

The attack mechanism began with malicious prompts embedded within repository README.md files. When developers opened these compromised repositories in Cursor, the AI agent would automatically process the hidden instructions without any additional user interaction required. This represented a significant escalation from simple prompt injection attacks that typically only affect AI model outputs.

Technical analysis revealed that Cursor's security protections failed to monitor shell builtin commands, creating a blind spot that attackers could exploit. The command parser tracked external command execution but overlooked internal shell operations like working directory changes and environment variable manipulation. This oversight allowed attackers to escape the intended security sandbox.

On macOS systems, the vulnerability became particularly severe due to Cursor's operation without sandbox restrictions. The macOS seatbelt sandbox permits writes to user home directories, enabling attackers to modify the .zshenv file. Since this file executes with every new Zsh shell instance, including Terminal windows and application-spawned shells, attackers could achieve persistent system access.

The exploitation process involved multiple sophisticated steps. After the initial prompt injection triggered the sandbox escape, attackers could deploy tunnel exploitation scripts that abused Cursor's built-in remote access functionality. The attack generated device codes and transmitted them to attacker-controlled servers, establishing authenticated GitHub sessions through Cursor's legitimate tunnel infrastructure.

This authentication mechanism provided attackers with persistent remote access to compromised developer machines. As long as the Cursor process remained active and the tunnel registration persisted, cybercriminals could maintain ongoing system access without triggering traditional security alerts.

Network-level detection proved nearly impossible because all attack traffic flowed through Microsoft Azure infrastructure, appearing identical to legitimate Cursor communications. This stealth capability made the vulnerability particularly dangerous for enterprise environments where security teams rely on network monitoring for threat detection.

The discovery timeline demonstrated effective collaboration between security researchers and AI tool developers. Straiker identified the vulnerability in January 2026 and responsibly disclosed it to Cursor in early February. The development team implemented comprehensive fixes in Cursor version 3.0, addressing all components of the attack chain.

This incident highlights broader security challenges facing AI-powered development tools. As these applications gain deeper system integration and more sophisticated capabilities, they present expanded attack surfaces that traditional security measures may not adequately address. The vulnerability underscores the need for specialized security frameworks designed specifically for AI agents operating in development environments.

The implications extend beyond Cursor to the entire ecosystem of AI coding assistants. Similar vulnerabilities may exist in other AI-powered development platforms that combine natural language processing with system-level access. Security researchers emphasize the importance of comprehensive security audits for AI tools that handle untrusted input while maintaining privileged system access.

Industry experts note that this discovery represents a significant evolution in AI security threats, demonstrating how prompt injection attacks can escalate from simple model manipulation to complete system compromise. The incident serves as a critical reminder that AI security requires specialized approaches that account for the unique risks posed by intelligent agents with system-level capabilities.