Bypass Record
Masquerading × Cursor AI IDE
A publicly-reported instance of Masquerading bypassing Cursor AI IDE, recorded with its original source. Factual record; no assessment of any specific deployment.
Reported as
When Cursor opens a repository, it automatically runs git.exe from the project's directory without validation, allowing a planted malicious git.exe to execute.
Mechanism
When Cursor opens a repository, it automatically runs git.exe from the project's directory without validation, allowing a planted malicious git.exe to execute. This defeats the application's own security model by executing untrusted binaries without user consent.
Detection & mitigation
Monitor for unexpected git.exe processes spawned from non-standard paths, especially from user-writable directories. Implement application control policies to block execution of binaries from untrusted locations.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.