CVE-2026-73217: 
Cursor IDE vulnerability analysis and mitigation

CVE-2026-73217 is a sandbox escape vulnerability in Cursor IDE for macOS that allows an AI agent operating in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper, enabling arbitrary host command execution outside the sandbox. It affects Cursor IDE versions prior to 3.1.2 and was disclosed on July 14, 2026, with the CVE published on August 11, 2026. The vulnerability carries a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-693 (Protection Mechanism Failure) — specifically, the Auto-Run Sandbox mode in Cursor IDE for macOS fails to prevent an agent from writing to or replacing the Python executable within a virtual environment. Because the Microsoft Python extension invokes the virtual environment's Python interpreter outside the sandbox boundary, a malicious wrapper placed at that path executes with the user's full host privileges rather than within the restricted sandbox context. This attack requires the presence of a virtual environment accessible to the agent and passive user interaction (e.g., the user having the Microsoft Python extension active), but requires no special privileges from the attacker's perspective (GitHub Advisory).

Successful exploitation allows an AI agent to break out of the Auto-Run Sandbox and execute arbitrary commands on the host macOS system with the privileges of the logged-in user. This includes modifying files outside the designated workspace, launching arbitrary applications, and potentially exfiltrating sensitive data accessible to the user account. The scope of impact is limited to the vulnerable system's user context, but the full confidentiality, integrity, and availability of user-accessible resources are at risk (GitHub Advisory, Feedly).

As of the time of publication, there is no evidence of active in-the-wild exploitation, and the SSVC assessment indicates exploitation is "none" (Feedly). The EPSS score is approximately 0.31%, reflecting a low but non-negligible probability of exploitation in the near term. No public proof-of-concept exploit code has been identified, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires specific preconditions: the target must be using Cursor IDE on macOS with Auto-Run Sandbox mode enabled and the Microsoft Python extension installed with an active virtual environment.

1. Precondition Setup: Ensure the target is running Cursor IDE (< 3.1.2) on macOS with Auto-Run Sandbox mode enabled, the Microsoft Python extension installed, and a Python virtual environment present in the workspace.
2. Agent Execution: Craft or influence an AI agent task within Cursor's Auto-Run mode that includes instructions to locate the virtual environment's Python executable (e.g., .venv/bin/python or similar path within the workspace).
3. Replace Python Executable: The agent, operating within the sandbox, replaces or wraps the virtual environment's Python binary with a malicious shell script or binary that executes attacker-controlled commands before (or instead of) invoking the real Python interpreter.
4. Trigger Extension Invocation: Wait for or trigger the Microsoft Python extension to invoke the virtual environment's Python interpreter (e.g., by running a Python file, activating the environment, or using extension features like linting or test discovery).
5. Achieve Host Code Execution: The malicious wrapper executes outside the sandbox with the user's host privileges, enabling arbitrary command execution — such as exfiltrating files, modifying system configurations, or launching applications beyond the workspace (GitHub Advisory).

• File System: Unexpected modification timestamps or content changes to Python executables within virtual environments (e.g., .venv/bin/python, env/bin/python); presence of shell scripts masquerading as Python binaries in virtual environment bin/ directories.
• Process: Unusual child processes spawned by the Microsoft Python extension process (e.g., bash, sh, curl, osascript) that are not typical Python interpreter invocations; processes with unexpected parent-child relationships originating from VS Code or Cursor extension hosts.
• Logs: macOS Unified Log entries showing unexpected application launches or file system modifications by the Cursor or Python extension process outside the workspace directory; audit logs recording writes to virtual environment binary paths by agent-related processes.
• Network: Unexpected outbound network connections from processes spawned by the Microsoft Python extension to external hosts, particularly shortly after Python environment activation (GitHub Advisory).

Cursor has released version 3.1.2, which fixes this vulnerability; users should update immediately (GitHub Advisory). As a workaround prior to patching, users can disable Auto-Run Sandbox mode or avoid using the Microsoft Python extension in conjunction with AI agent tasks that have write access to virtual environments. Additionally, restricting agent permissions to read-only access on virtual environment directories can reduce exposure until the patch is applied.

The vulnerability was reported by security researcher Danus365 and disclosed via GitHub's security advisory process by Cursor maintainer mcpeak on July 14, 2026 (GitHub Advisory). No significant broader media coverage or notable public researcher commentary beyond the advisory has been identified at this time.