Beltdown2: Escaping the Cursor CLI sandbox

Your Cursor CLI can now be made to run arbitrary code on your Mac without any prompt, even when you attempt to restrict it.

Researchers discovered a critical security vulnerability in Cursor's macOS CLI sandbox, dubbed "Beltdown2." The exploit allows an attacker-controlled workspace, specifically a .git/ directory, to bypass the sandbox and execute arbitrary code on a user's Mac with the logged-in user's full authority and no permission prompt. This bypass is similar to a previous vulnerability found in Claude Code (Beltdown) but is more severe due to a complete lack of Git hardening in Cursor's implementation. The vulnerability stems from Cursor's sandbox only confining the shell tool, while its internal Git process, which executes repository-supplied hooks like core.fsmonitor, runs unsandboxed. A proof-of-concept involved a specially crafted .git/config file that triggered an escape during a read-only prompt, demonstrating that the issue is not tied to specific agent capabilities but rather a systemic pattern in how sandboxing is implemented. Cursor has since released a fix in version 2026.08.04-aaa8809, which hardens all Git spawns universally.

The core issue lies in the architectural disparity between how Cursor sandboxes its shell commands and how it handles its internal Git operations. By leveraging the `core.fsmonitor` Git configuration, which executes external scripts, attackers can trick Cursor's unsandboxed Git process into running malicious code. This bypasses the intended security of the Seatbelt sandbox, as the Git process is not subject to the same restrictions as the shell. The ease with which this exploit can be triggered, even with read-only prompts and no explicit shell command execution, highlights a significant oversight in Cursor's security hardening for its developer tools.

This vulnerability underscores a broader pattern in agent-based development tools: the challenge of securely integrating external code execution and repository-controlled configurations within sandboxed environments. The fix implemented by Cursor, which uses environment variables to universally harden Git spawns, represents a robust solution to prevent repo-controlled executable Git configs from escaping. Developers should be wary of similar vulnerabilities in other tools that rely on internal processes running outside a strict sandbox, especially when those processes interact with potentially untrusted repository configurations.