DuneSlide: Two LLM-Controlled Paths Escaped Cursor's Terminal Sandbox

Place terminal and file tools inside an operating-system sandbox below Cursor's application helper. The profile should deny writes to the application bundle and other host paths even if the model, tool schema, or cursorsandbox wrapper is compromised. This is the strongest independent containment layer for the final RCE path.

Inventory Cursor 2.x deployments, rebuild managed images with Cursor 3.0 or later, and verify the two disclosed paths in an isolated regression test. A version label alone is not closure evidence; the deployed population and helper integrity must match the fixed build.

In a controlled run_terminal_cmd adapter, reject the optional working_directory parameter or constrain it to an exact administrator-approved project root that the model cannot replace. This blocks the demonstrated parameter-expansion path; JSON Schema does not resolve symlinks, bind opened objects or repair the independent Write-tool flaw. The root and effective sandbox write policy require independent validation.

Replace ambient file writes with single-purpose project operations that receive bounded object IDs or root-relative paths. A coding agent should not possess a generic primitive that can rewrite its own enforcement helper or arbitrary application files, regardless of what an injected instruction requests.

Immediately before each cursorsandbox invocation, a protected launcher must verify the complete native helper bytes and runtime dependencies against an independently signed manifest, then execute the same verified bytes. G005's sample enumerates Python tool files and does not cover this native helper unchanged; Cursor-specific inventory and launch enforcement are required. This gate stops later use of a modified helper, not the earlier write. Keep medium supporting relevance until the vendor or controlled launcher proves every invocation and substitution path covered.