CVE-2026-61613: Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Curso

Cursor is a code editor that uses AI to help with programming. Before a fix on March 31, 2026, attackers could use malicious web content to connect to an unprotected local endpoint (a communication point on a user's computer) in Cursor's Cloud Agent, allowing them to run code, steal files, access environment variables (settings that programs use), steal credentials (login information), and take GitHub App access tokens (digital keys that grant permissions to GitHub accounts).