AI Code Editor Vulnerability Patched: Slack Misuse Thwarted by Quick Response

Cursor patches Slack-triggered code execution flaw

At a glance

• Immediate action: Cursor, a popular AI code editor, patched a serious security flaw.
• Exploit potential: A malicious Slack message could trick the editor’s AI agent into running an attacker’s code.
• Developer response: Cursor shipped a fix in version 1.3.9; users on 1.2.1 or earlier should update.
• Collaboration and transparency: Researchers reported the flaw privately, and Cursor published an advisory.

The flaw

Cursor is an AI-powered code editor built to speed up developers’ work. Researchers found a flaw in it. Tracked as CVE-2025-54135 and nicknamed “CurXecute,” it let an attacker run code on a developer’s machine, which is about the worst thing that can happen with a tool that already sits on top of source code, API keys and cloud credentials.

How Slack came into it

Cursor can connect to outside services such as Slack through the Model Context Protocol (MCP), so its AI agent can read messages and other data. Researchers showed that an attacker could post a message with hidden instructions in a Slack channel. When a developer asked Cursor’s agent to work with that channel, the injected text could get the agent to rewrite its MCP configuration file and start an attacker’s command, without asking the user first.

The fix

Cursor patched the issue after researchers reported it. Version 1.3.9 is the fix.

The fix changes how the editor handles edits to sensitive MCP configuration files, so a prompt injection can no longer quietly add and launch a new server.

Disclosure done right

The case shows how coordinated disclosure should work. Report privately, fix, publish.

AI agents bring new risks

The incident is a reminder that AI coding agents create a new kind of attack surface. Anything the agent reads, including chat messages, web pages and documents, can carry instructions an attacker planted.

Keep AI tools updated. Limit which outside services an agent can reach, and require approval before an agent changes its configuration or runs a command on your machine, even when that slows things down a little.

What developers should take from it

This flaw shows how quickly risks can appear when AI agents get access to outside data and the power to run code. It also shows the value of fast patching and clear advisories.

Teams using AI editors should check that they run a patched version and review which integrations their agents can use.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.