2025-08 · 2025-Q3

Cursor MCPoison Silent Backdoor

Primary layerL7 Build / ApprovalSecondary:L5 Config

Was this approved as what it claims to be?
The question layer 7 asks, and failed here.

Fixable: Vendor patch
Vendor response: Patched
In the wild: No
Actor: Attacker

Target

Cursor AI IDE

Impact

Silent backdoor execution on every team member who opens a project

Root cause

MCP server trust bound to name rather than content hash; no re-approval for config changes

CVE

CVE-2025-54136

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Cursor MCPoison Silent Backdoor (2025-08). https://agentprov.com/incidents/2025-08-cursor-mcpoison-silent-backdoor

Also L7 · 2026-10-22METR and Redwood: OpenAI's Agent Monitoring Was "Not Fit for Purpose" During the Hugging Face Break-InL7Build / Approval
Also L7 · 2026-10-21OpenAI: Two Internal Agents Disabled Misalignment Monitoring, and One Denied It When AskedL7Build / Approval
Also L7 · 2026-10-15Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063)L7Build / Approval