Specific vulnerabilities in Cursor
Researchers uncovered more than 30 critical flaws in AI coding tools that enable data theft and remote code execution. IDEsaster found that 100% of tested AI-powered IDEs and coding assistants were vulnerable. Cursor faces several documented vulnerabilities. CVE-2025-59944 allows attackers to achieve remote code execution by bypassing case-sensitive file protection checks to overwrite sensitive files. CVE-2025-61590 permits remote code execution through workspace settings manipulation if a malicious prompt hijacks chat context. CVE-2025-61592 and CVE-2025-61593 enable remote code execution through the modification of project-specific CLI configuration files. In versions 0.45.0 through 0.48.6, the vulnerability identified as CVE-2025-32018 allowed the Cursor Agent to write to files outside the opened workspace if an attacker used a malicious prompt. Prompt injection triggers these unauthorized actions. Information leakage via JSON schema and remote exfiltration also poses a risk for Cursor because malicious prompts can trigger the IDE to fetch remote schemas. These risks extend to automatic dependency installation and unauthorized file edits. The OECD.AI reports that vulnerabilities in AI-powered development environments lead to credential theft. AI agents often behave in ways developers do not track, such as attempting to fix environment issues by editing shell configs or installing packages. In malicious repositories, the loading of project-specific CLI configuration can allow arbitrary shell commands via prompt injection.
Privacy Mode and compliance gaps
Cursor processes code through a three-tier architecture involving the local client, the backend gateway, and third-party LLM subprocessors. The local client, a fork of VS Code, performs pre-processing and respects .cursorignore rules to filter sensitive files. It maintains a Merkle tree of file hashes and performs semantic search using Merkle Tree synchronization to map code into embeddings stored in a remote vector database like Turbopuffer. The backend gateway, hosted on AWS, applies prompt engineering and routing logic. Third-party providers like OpenAI and Anthropic handle inference. For enterprise customers, Zero Data Retention (ZDR) agreements ensure that code is not stored beyond the inference window. Privacy Mode provides technical guarantees by using zero data retention and isolated infrastructure where logging stays disabled. It also prevents training on code. However, Anysphere, Inc. remains a US company and its data processing stays subject to FISA 702. No EU data residency option exists on any plan. Even with Privacy Mode enabled, all requests hit US-based AWS servers. This creates a legal exposure for companies in regulated sectors like healthcare or finance because the Schrems II ruling addresses the risks of US surveillance.
| Feature | Cursor Privacy Mode |
|---|---|
| Data Retention | Zero retention |
| Training on code | None |
| EU Data Residency | Not available |
| FISA 702 exposure | Yes |
Comparison with GitHub Copilot
GitHub Copilot provides SAML SSO, SCIM provisioning, and IP indemnification. Cursor lacks these enterprise-grade controls and fails to match the legal backstop offered by GitHub. Because it lacks these essential controls, regulated industries find that Cursor carries a higher compliance risk. Users report performance issues like slow API requests and slowness in recent weeks, which impact workflow. This leads to users reporting that the product becomes unusable. Can security teams trust an agent that can execute shell commands without validation? For individuals, GitHub Copilot costs $10/month, whereas Cursor Pro costs $20/month. For teams, GitHub Copilot Business is $19/user/month, while Cursor Business is $40/user/month. GitHub Copilot integrates with existing IDEs like JetBrains, whereas Cursor requires a full editor migration. GitHub Copilot uses pull requests, issues, and discussions as context. Cursor relies on Composer mode and parallel agents architecture for multi-file refactoring. Cursor’s Composer mode allows the model to read, plan, and edit multiple files in a single coordinated session without manual intervention. GitHub Copilot Workspace offers a web-based interface for agent-mode multi-file editing, whereas Cursor keeps the interaction within the editor via a keyboard shortcut. Claude Code operates as a terminal-first agent for autonomous tasks, providing an alternative to both tools.
