Data Exfiltration via MCP Server Prompt Injection Targeting Cursor
Cursor, Model Context Protocol
Researchers showed that a malicious Model Context Protocol server can deliver an indirect prompt injection to the Cursor IDE. This injection tricked the AI agent into executing shell commands to exfiltrate configuration files.
- first report
- 30 Jan 2026
- last update
- 30 Jan 2026
Timeline · 2
Sources · 2
News and write-ups
- 2026-01-30Simulating a Context-Poisoning Vulnerable MCP Server: A POCbackslash.security · backslash.security/blog/simulating-a-vulnerable-mcp-server-for-context-poisoning
Research and catalogues
- 2026-01-30Data Exfiltration via an MCP Server used by CursorMITRE ATLAS · atlas.mitre.org/studies/AML.CS0045
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionAgent hijackData leak
- severity
- 1 · Research / proof of concept
- targets
- Framework / tooling, Enterprise deployment
- owasp llm top 10
- LLM01:2025 Prompt InjectionLLM02:2025 Sensitive Information DisclosureLLM06:2025 Excessive Agency
- dates
- happened 24 Jun 2025 · first reported 30 Jan 2026
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Data Exfiltration via MCP Server Prompt Injection Targeting Cursor https://gcdradar.vercel.app/incidents/data-exfiltration-via-mcp-server-prompt-injection-targeting · AIR-2026-0341 · closed 2026-02-13 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2026-01-30 (happened 2025-06-24) - AI role: Attack on AI - Products: Cursor, Model Context Protocol ## Summary Researchers showed that a malicious Model Context Protocol server can deliver an indirect prompt injection to the Cursor IDE. This injection tricked the AI agent into executing shell commands to exfiltrate configuration files. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-01-30: Simulating a Context-Poisoning Vulnerable MCP Server: A POC (https://backslash.security/blog/simulating-a-vulnerable-mcp-server-for-context-poisoning) - 2026-01-30: Data Exfiltration via an MCP Server used by Cursor (https://atlas.mitre.org/studies/AML.CS0045) ## Sources - 2026-01-30 MITRE ATLAS: Data Exfiltration via an MCP Server used by Cursor https://atlas.mitre.org/studies/AML.CS0045 - 2026-01-30 backslash.security: Simulating a Context-Poisoning Vulnerable MCP Server: A POC https://backslash.security/blog/simulating-a-vulnerable-mcp-server-for-context-poisoning Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedMCP SDKs Credential Exfiltration via Remote Poisoned MCP Tool
Research · since 1 Apr 2025
AI - closedLenovo AI Chatbot Lena Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot
Research · since 18 Aug 2025
AI - closedLLM Desktop Applications AIKatz Extracts Authentication Tokens from LLM Desktop Apps
Research · since 2025 (approx.)
AI - closedSlack AI Data Exfiltration from Slack AI via Indirect Prompt Injection
Research · since 20 Aug 2024
AI - closedCopilot Studio Data Exfiltration via Prompt Injections in Copilot Studio Agent
Research · since Jun 2025 (approx.)
AI - closedClaude Code GitHub Action Claude Code GitHub Action Secret Exposure via Prompt Injection
Research · since 5 Jun 2026
AI