Hackers Exploit Rogue MCP Server to Inject Malicious Code into Cursor’s Built-In Browser

Security researchers have uncovered a critical vulnerability in Cursor, the AI-powered code editor, that allows attackers to inject malicious code through rogue Model Context Protocol (MCP) servers.

Unlike VS Code, Cursor lacks integrity checks on its runtime components, making it vulnerable to tampering through MCP server registration.

The attack works by registering a local MCP server that completely circumvents Cursor’s built-in security controls. When an unsuspecting developer enables a malicious MCP server and restarts Cursor, the browser becomes compromised.

Attackers can inject arbitrary JavaScript code that hijacks the internal browser, replacing legitimate login pages with credential-harvesting fakes that send stolen credentials to remote servers.

How the Attack Functions

The vulnerability stems from Cursor’s failure to verify the integrity of Cursor-specific features during runtime.

Researchers created a proof-of-concept by modifying internal, unverified code during MCP server registration.

This modification injects malicious code into Cursor’s browser without requiring special permissions or checksum recalculation.

The attack executes by assigning document.body.innerHTML with attacker-controlled HTML, effectively rewriting the entire page body and erasing prior DOM state.

This technique bypasses UI-level security checks entirely. Once active, every browser tab Cursor opens and executes the injected payload, creating a persistent attack surface.

The process requires three steps: enabling the MCP server, restarting Cursor to apply the changes, and running the malicious JavaScript in the embedded browser.

This represents a dual-layer eval attack that provides attackers with extensive capabilities.

This vulnerability demonstrates a broader threat landscape where coding agents introduce expanding attack surfaces daily.

MCP servers require broad permissions to function, meaning compromised servers can modify themselves, escalate privileges, and gain new capabilities without user visibility.

Attackers can perform any action the compromised user can, with minimal controls in place to mitigate risk.

The emerging supply chain risks associated with AI agents are significant. Yet, organizations maintain minimal visibility into their deployment and usage.

MCP servers, extensions, and even simple prompts can execute code in user environments and corporate networks without detection.

Developers should carefully check any MCP server or extension before using it. Verify the project’s GitHub repository and thoroughly review the source code before installation.

Never unquestioningly enable functionality, especially MCP features, and avoid using auto-run modes that bypass user oversight.

Additionally, developers should manually review code generated by AI agents before executing actions in embedded browsers.

The consequences of misplaced trust in developer tooling can extend beyond individual machines, compromising entire corporate networks.

While Cursor was notified before publication, this discovery reinforces that the developer’s machine has become the new cyber defense perimeter.

Organizations must implement comprehensive supply chain security measures, including reputation systems for safe ingestion and posture management capabilities, to protect against evolving threats targeting AI-powered development environments.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and set GBH as a Preferred Source in Google.