Post

TIL about a VSCode vulnerability involving auto-run tasks inside a repo. That got me thinking: could I use this to re-program a developer's AI agents and get them to do what I want? Even worse — could I do this to all a developer’s code repositories? Turns out: hell yes. ike.io/open-a-folde...

ike.ioExploit Cursor Agents to create persistent, distributed threatsSimply opening a folder can give an attacker a foothold into all the code bases a developer maintains.

Loraine Lawson

@lorainelawson.bsky.social

23 Jan

OMG. I loved your story. I'd like to boost it by writing about it on The New Stack. Can I ping you if I have questions or need a quote?

ike

@ike.io

absolutely!

23/1/26, 3:44 pm0 reposts0 likes

Loraine Lawson

@lorainelawson.bsky.social

Is there a fix

There are recommended mitigations that you can apply as outlined in the Oasis report, but in Cursor those remediations disable the AI features (which defeats the point). At this time, the fix is 1) enabling Workspace Trust and 2) thoroughly reading the tasks.json file OUTSIDE of VSCode/Cursor

Loraine Lawson

@lorainelawson.bsky.social

23 Jan

I'm going to add that. I wrote it from your post and Github. Please send a notification or ping me if anything needs fixing. thenewstack.io/developer-pr...

thenewstack.ioDeveloper proves AI agents can be reprogrammed via new exploitA zero-click vulnerability in the tasks.json file allows attackers to silently hijack Cursor’s instructions across code repos.