The Slow Blade Penetrates the Shield: DuneSlide Overwrote Cursor's Sandbox Guard. We Published the Opposite Claim Five Days Ago.
- Patrick Duggan
- 16 minutes ago
- 5 min read
In Dune, a Holtzman shield stops anything moving fast. Gurney Halleck teaches Paul the counter in one line: the slow blade penetrates the shield. You do not overpower the barrier. You move slowly enough that it does not consider you a threat.
Cato AI Labs just did that to Cursor, and the researchers named the finding well. DuneSlide — CVE-2026-50548 and CVE-2026-50549, both 9.8 — lets instructions hidden in a web page or an MCP response walk past the sandbox by overwriting the thing that enforces the sandbox. No click. No approval dialog. Every version of Cursor before 3.0.
Credit for the discovery and the teardown belongs to Cato AI Labs, cleanly. We did not find this, we did not predict it, and there is no receipt in our feed with our name on it. What we have is a correction to make and a pattern to name.
The two bugs are the same bug wearing different clothes
Both are fail-open. Both end at the same file.
The first, CVE-2026-50548, is about where the agent says it is working. Cursor lets the agent set a working directory, and when that value points somewhere non-default, Cursor adds the path to the allowed-write list without question. Injected instructions point it at a system path instead of the project. Now the writable list includes the sandbox helper — the binary that decides what the sandbox permits. Overwrite that, and every command afterward runs with no barrier, because the guard is now a file the attacker wrote.
The second, CVE-2026-50549, is about a safety check that gives up politely. Cursor validates symbolic links by canonicalizing the path. When canonicalization fails, it falls back to trusting the shortcut's in-project path. A check that fails open is not a check. Same destination: a write to the same sandbox helper, without approval.
Neither is clever. That is the point worth sitting with. There is no exotic memory corruption here, no novel primitive. It is a permissions list that trusts its input and a validator that treats its own failure as a pass. The slow blade does not need to be sharp.
The delivery is the part that should worry you
You do not have to install anything. You do not have to approve anything. The trigger is content the agent reads on your behalf: a poisoned web search result, or a response from an MCP-connected service.
That is a genuinely different threat model from the one most teams are still defending. The mental picture of "developer gets phished" involves a developer making a mistake. Here the developer does nothing wrong and does nothing at all. They ask their editor a question, the editor consults a source, and the source answers with instructions instead of information.
Where we were wrong
Five days ago we published a post about Pillar Security's research into four coding agents, and we built it on this line: nobody attacked the sandbox — they just wrote a file the grown-ups outside trusted.
That was accurate about Pillar's research. It is not accurate as the general claim it invited, and we wrote it in a way that invited it. DuneSlide attacks the sandbox. Directly. It overwrites the enforcer. The comfortable version of this story — the escape always goes around the wall, so harden what is outside the wall — is now incomplete, and we helped make it comfortable.
We are naming that because a thesis that only ever gets confirmed is not a thesis, it is a brand. Ours took a hit this week from research we did not do.
Fixed April 2. Told you in July. And they said no first.
Cato's timeline is the most instructive part of the whole disclosure, so here it is with the dates attached:
February 19 — Cato reports both issues to Cursor. February 23 — Cursor rejects the reports. February 26 — Cato escalates. Cursor reopens and triages. April 2 — Cursor 3.0 ships with the fixes. June 5 — CVE IDs assigned. July — public disclosure.
Four days from report to rejection. Five months from fix to the general public understanding there was something to fix.
The fix has been sitting in a release since April. Anyone who upgraded to 3.0 for unrelated reasons has been safe for nearly four months without knowing why. Anyone still on 2.x has been exposed for that same stretch, also without knowing why, because the release that saved everyone else did not come with a sign explaining what it saved them from.
We wrote a different version of this same story today about GitLab: a fix that shipped in June under a "bug fixes" label, with no CVE, and a working exploit published six weeks later. Two unrelated vendors, one shape. The patch arrives long before the warning does. If your patching discipline is driven by advisories — and most is, because advisories are what generate tickets — you are structurally behind on every bug that gets quietly fixed first. The vendor did the work. Nobody told your change board it mattered.
The vector points at us too
The injection can arrive through an MCP-connected service. We operate one: jeevesus, our threat-intelligence MCP server, which returns corpus data to AI agents on request. It would be cowardly to write this post and not say what ours does.
Every result jeevesus returns is tagged untrusted_content: true, and every response carries an explicit line telling the calling model to treat the result text as data, not instructions. That is a real control and you can verify it yourself by calling the server. It is also not sufficient on its own, and we are not going to pretend otherwise — it is a label asking a model to behave, and a label is a request, not a boundary. The durable fix has to live in the client: do not let a tool response widen a permission, and do not let a validator that failed count as a validator that passed.
Which is exactly what DuneSlide proves, from the other side of the connection.
What to do tonight
Upgrade Cursor to 3.0 or later. Everything before it is affected. If you inventory developer tooling at all, this is the query to run, and pre-3.0 installs are the answer you do not want to find.
Check whether your agents can reach MCP servers you do not control. The injection arrives as ordinary content from a source your agent already trusts. An allow-list of MCP endpoints is worth more this week than it was last week.
Stop treating "no CVE yet" as "no problem yet." Between DuneSlide and the GitLab bug, the honest read is that a meaningful share of your real exposure is already patched in a release you have not installed, described in a changelog line nobody flagged. Version currency is a control. Advisory-driven patching is a lagging indicator by design.
Assume the sandbox is a participant, not a referee. The whole appeal of a sandbox is that it does not depend on the agent behaving. DuneSlide is what it looks like when the sandbox's own enforcement lands inside the blast radius.
There are no network indicators to publish with this one — DuneSlide is a software defect, not a campaign, so there is nothing to feed and nothing to block. The CVEs sync into our KEV mirror automatically if CISA ever adds them. Neither is listed as known-exploited today. That is a comfort with a short shelf life: the technique is now public, the affected version range is enormous, and the barrier to entry is a web page.
Shields work. That was never the argument. The argument is that a shield teaches an attacker exactly how slowly to move.
Research credit: Cato AI Labs (formerly Aim Security), who reported on February 19, got told no on February 23, and kept going. The industry runs on researchers who escalate after the first rejection.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.