DeepJack: One Click on a Cursor Deeplink Installs an MCP Backdoor

Cursor IDE’s deeplink handler has a problem. A crafted cursor:// link — the kind used to install MCP servers — can silently deploy an attacker-controlled server on a developer’s machine with one click and one dialog approval. The attack, called DeepJack, was disclosed by Adversa AI on July 15, 2026. It bypasses Cursor’s own fix for the previous deeplink vulnerability. As of build 3.9.8, it still works.

How DeepJack Works

The predecessor attack, CursorJack (CVE-2025-54133), abused the cursor://anysphere.cursor-deeplink/mcp/install endpoint directly. Cursor patched it in version 1.3 by surfacing the full command in the install dialog — so users could at least see what they were approving before clicking.

DeepJack defeats that fix in two ways.

The first variant exploits the dialog’s single-line text field. An attacker appends a malicious command after a legitimate-looking server name, then pads it with enough whitespace to push the bad part off the right edge of the visible area. The user sees a clean-looking command. The rest is off-screen. They click Approve.

The second variant hides an mcp/install URI inside a pr-review URL parameter using double-URL encoding. Cursor never recursively decodes nested URIs, so what renders as a pull request review link actually installs an MCP server. The click feels like opening a code review. The effect is handing an attacker a foothold on your machine.

Both are documented under Adversa AI’s full technical disclosure. The underlying weaknesses are CWE-88 (argument injection) and CWE-939 (improper authorization for critical function).

Cursor Knew for Months

Here is where the story gets frustrating. Cursor confirmed the root cause internally on April 27, 2026. A partial fix shipped on July 13 — nearly three months later. No CVE was filed. No security advisory was published. No user notification went out.

Adversa AI published their findings on July 15. Cursor has not publicly explained the gap between internal confirmation and public disclosure, nor why the partial fix shipped without any accompanying advisory. If you are on 3.9.8, you are not safe. Check Help > Check for Updates.

What an Attacker Gets

A developer machine is not a low-value target. An attacker-controlled MCP server runs with full user privileges and persists across restarts. In practice, that means access to:

• SSH keys in ~/.ssh/ — enabling lateral movement to every server the developer can reach
• Cloud credentials — AWS ~/.aws/credentials, GCP tokens, Azure tokens
• GitHub tokens and source code
• LLM API keys (and the billing accounts behind them)
• Every other MCP-connected service: Jira, Slack, databases, internal APIs

This is not a temporary code execution. It is a durable foothold on one of the highest-privilege machines in any engineering organization.

DeepJack Is a Symptom, Not the Disease

The Cloud Security Alliance documented MCP’s core problem in April 2026: the STDIO interface executes OS commands passed through configuration parameters without validation. This is not an implementation bug in Cursor — it is a design default embedded in every official MCP SDK. Anthropic confirmed the behavior is intentional and declined to modify the protocol architecture, putting remediation on individual developers and tool vendors.

As of mid-2026, there are over 40 documented CVEs across MCP implementations, affecting Cursor, LiteLLM, LibreChat, Windsurf, and MCP Inspector. DeepJack is the predictable consequence of deploying a protocol built without authentication, authorization, or input validation to hundreds of thousands of developers. Proofpoint’s original CursorJack research called this out last year. The attack surface has only grown since.

What to Do Right Now

Do not wait for Cursor to ship another patch without an advisory. Take these steps today:

1. Audit your MCP servers: Run cat ~/.cursor/mcp.json and verify every entry is something you knowingly installed.
2. Update Cursor: Go to Help > Check for Updates. If a newer build is available, install it.
3. Enable MCP Tool Protection in Cursor Settings if you have not already.
4. Do not click cursor:// links in emails, Slack messages, GitHub comments, or anywhere else unless you can independently verify the source.
5. Enterprise teams: Disallow project-local MCP servers via managed config. Maintain an allowlist of vetted servers. This single control closes the entire class of deeplink-based MCP install attacks.

The GitHub Security Advisory GHSA-4575-fh42-7848 is the canonical reference for tracking this fix. Watch it. The CSA’s MCP STDIO research lays out the systemic context if you want to understand why these vulnerabilities keep appearing.

MCP is a young protocol being adopted at a pace that has outrun its security model. Until Anthropic ships authentication primitives in the spec, every IDE that implements MCP install-via-deeplink is carrying this risk. For Cursor users, today’s action item is simple: audit, update, and stop trusting links you did not initiate.