AGENTS CRITICAL NEW
DuneSlide：提示注入逃逸 Cursor IDE 沙箱，直达系统级 RCE
Cato AI Labs（2026 年 7 月 1 日）表明，一条被投毒的提示——经由 MCP 服务器或网页结果——即可覆写 Cursor 的沙箱二进制文件，实现零点击的系统级 RCE。已在 Cursor 3.0 修复。
2026-07-22 // 5 min
阅读完整分析 →
# example prompt — illustrative, defensive
# DuneSlide: prompt injection escapes Cursor's sandbox (illustrative, defensive) # Zero-click indirect injection arrives via an MCP result or fetched web page: hidden = "[hidden instruction in untrusted content]" # It steers run_terminal_cmd's OPTIONAL working_directory outside the project, # silently widening the sandbox write allowlist a model-set arg controls: run_terminal_cmd(working_directory="[system path]", command="[REDACTED]") # -> next command runs unconfined -> OS-level RCE as the developer. # Defense: upgrade to Cursor 3.0; derive sandbox scope from trusted policy, # not tool args; canonicalize symlinks and FAIL CLOSED; block writes to binaries.