DuneSlide: Cursor Prompt-Injection Sandbox Escape (CVE-2026-50548/50549)
Security researchers disclosed two critical vulnerabilities in the Cursor coding agent, dubbed "DuneSlide" (CVE-2026-50548 and CVE-2026-50549), that let prompt injection break sandbox containment and execute arbitrary commands on the developer's machine.
What Happened
DuneSlide is a pair of chained flaws in Cursor's coding-agent sandbox. An attacker-controlled prompt — embedded in a file, a dependency, or content the agent was asked to read — could manipulate the agent into stepping outside its intended sandbox boundary and running arbitrary commands with the developer's own permissions. No social engineering of a human was required; the injection targeted the agent directly. Cursor shipped version 3.0 to patch both CVEs, but any project still running an older build remains exposed.
Why This Matters for Thuban
DuneSlide is another entry in a fast-growing pattern: sandbox boundaries in AI coding agents are being treated by attackers as a normal, expected attack surface — not an edge case. That pattern shows up in:
- Prompt injection is now a reliable delivery mechanism for sandbox escapes, not just a jailbreak technique.
- A single hostile file, dependency, or web page the agent reads can be enough — no human has to click anything.
- Vendor patches close individual CVEs, but the underlying trust assumption (the agent will stay inside its lane) keeps failing across different products.
- Version currency alone isn't a security strategy — teams need independent verification that containment actually held, not just a changelog that says it should.
Independent of Vendor Patch Cycles
Runtime enforcement doesn't wait for the next CVE fix release to catch the behaviour.
Execution Gate
Commands an agent attempts to run are checked against policy before they execute — regardless of how the agent was manipulated into requesting them.
File Guard
Sensitive files and injected content sources are watched independently of whether the agent's own sandbox logic is intact.
Immutable Audit Evidence
A hash-chained record of what was attempted and why it was allowed or blocked, independent of the agent's own self-reporting.
Positioning
Vendors patch the sandbox they built. Thuban independently verifies the sandbox held — on every run, not just the ones covered by the latest CVE fix.
Product Implication
DuneSlide reinforces why Shield's execution gate and file guard sit outside the agent's own containment logic rather than trusting it: when the agent itself is the thing being manipulated, a defence that depends on the agent behaving correctly has already lost. This is exactly the kind of incident Forge is built to turn into a hardened detection rule — not after the fact, but as part of a continuous pipeline of real-world attack patterns feeding back into Shield and Guardian.
Sources
Is your coding agent's sandbox actually holding?
Free, no signup, runs entirely locally — your code never leaves your machine.
npx thuban protectIndependent runtime monitoring and enforcement for Claude Code, Codex, Cursor, Gemini CLI — any AI coding agent.