What happened
Prior to a 03/31/2026 fix, Cursor's browser-enabled Cloud Agent sessions exposed an unauthenticated local agent endpoint reachable from any web content rendered inside the agent's browser, letting a malicious webpage visited by the agent pivot into code execution inside the agent's own sandboxed session.
Why it matters
This is a cross-boundary attack where untrusted web content an AI coding agent browses can escape into the agent's execution sandbox and steal the session's credentials (including GitHub App tokens), demonstrating a novel agent-execution attack class combining browser-use tooling with unauthenticated local control-plane endpoints.
Attack vector
Attacker-controlled web content loaded inside a browser-enabled Cursor Cloud Agent session could connect from inside the agent container to an unauthenticated local agent endpoint, achieving code execution within the sandbox and exfiltrating files, env vars, credentials, and GitHub App access tokens available to that session.
Affected systems
Cursor Cloud Agent (browser-enabled sessions), fixed 2026-03-31
Mitigation
Fixed by Cursor on 2026-03-31 by requiring authentication on the affected local agent endpoint; ensure Cursor Cloud Agent clients are updated past the fix. See GHSA-whx2-4gvm-m3r3.