According to the research, one malicious command, for example through prompt injection, can give an attacker root on the virtual machine running the agent, and from there run commands and read files in the account from anywhere. Because all agents in an account share a single Linux user and file system, the attacker gains access to everything the agent has stored: cookies, API keys and credentials for connected services such as email and calendar.
The researchers found several more failures: the authentication token of the command-execution service was identical across all environments tested, and was the word "local"; the Chrome browser in the environment ran with an unauthenticated debugging interface open; and the researchers found the private key used to sign Cursor's browser extension. They say rotating tokens does not remove an attacker who is already inside.
According to Geektime, Profero reported the findings to xAI and Cursor in late August. Cursor sent an automated bug bounty reply and xAI did not respond. More than 240 builds have shipped since, and according to the researchers none of the critical flaws has been fixed. Organizations using the agent should review which permissions and connections it has been given.