AgentArmorHQ
Sign in
Prompt injection

Review Every Agent Write to MCP Config Files Before Approving It

AgentArmorHQ team1 min read

You will confirm your Cursor version includes the fix and review agent changes to MCP config files before accepting them. This matters because an agent write to .cursor/mcp.json was chained into remote code execution.

Before 1.3.9

  • Agent creates new in-workspace files without approval
  • Injected prompt can write .cursor/mcp.json
  • MCP config change can run without user approval

After 1.3.9

  • Agent is blocked from writing MCP-sensitive files without approval

Why it matters

In Cursor, the agent could write files inside the workspace without approval. Editing an existing dotfile needed approval, but creating a new one did not (source (opens external site)). Chained with an indirect prompt injection, an attacker could make the agent write .cursor/mcp.json and trigger remote code execution, rated CVSS 8.5 (CVE-2025-54135 (opens external site)). Treat any change to that file as a change that can run code.

Steps

  1. Update Cursor to 1.3.9 or later. That release blocks the agent from writing MCP-sensitive files without approval (source (opens external site)).
  2. Confirm the version you run before you open untrusted repos with an agent. If you are below 1.3.9, update first.
  3. When the agent proposes a change to an MCP config file, read the full change before you approve it, including any new entries it adds.
  4. Watch for new dotfiles, not only edits. The original gap was in file creation, so review files the agent creates under .cursor/ as closely as edits to existing ones.
  5. Reject any MCP server entry you do not recognize, and do not approve it until you understand what it launches.
  6. Keep agent sessions on repositories you have not vetted to a minimum, since the injection risk in this incident came from content the agent read while working.
  7. If you approved an unknown MCP entry and it ran, rotate any credentials that process could read.

Common mistakes

  • Assuming the approval prompt covers new files. The original flaw was exactly that new files skipped approval.
  • Approving a batch of agent changes without reading each config change.
  • Running the agent on untrusted repositories on an older Cursor build.
  • Assuming the editor is fine because it still starts.

Notes

These steps reduce risk; they do not replace updating Cursor.

Checklist

0 of 6 done

Sources

  1. Cursor (GitHub security advisory): GHSA-4cxx-hrm3-49rm
  2. NVD: CVE-2025-54135
Was this guide useful?