AI programming tool Cursor has a vulnerability, and hackers can exploit CopyPasta attacks
Source: Binance
Time: 2025-09-05 13:04:13
According to BlockBeats, on September 5, cybersecurity company HiddenLayer reported that there was a "CopyPasta license attack" vulnerability in AI programming tool Cursor. Hackers can hide malicious directives in LICENSE.txt and README.md files, inducing AI tools to inject vulnerabilities into the code base.
The attack uses Markdown annotation to hide prompt injection, allowing the AI to automatically propagate malicious loads when editing files. Tests show that AI programming tools such as Windsurf, Kiro and Aider also have vulnerabilities. Malicious code can create backdoors, steal sensitive data, or silence the system, and can hide deeply to avoid detection.