In Forever Security’s Cursor test, untrusted page JavaScript invoked a browser bridge event and supplied selected-element attributes to the agent composer. The attributes were not just visual page content: they influenced instruction construction and pushed the coding agent toward a package installation. In the demonstrated chain, a sandbox-denied attempt…
Inspect the ClaimsCase · DiggingBeagle record
Cursor browser bridge turned selected page attributes into an agent command path
An attacker-controlled preview page could marshal hidden element attributes into Cursor agent instructions through a browser-to-composer bridge.
Scope
A local preview page, the affected Cursor bridge, user interaction and an agent with command-running permissions form the demonstrated attack path. There is no verified real-world victim count.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
The researcher observed a patch but did not identify a universal fixed build; exploit steps were conditional and controlled. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-CURSOR-BROWSER-BRIDGE-1 · EMBRACE: embedded AI-assistant browser attack paths
At a glance
Bridge-origin metadata is not a user instruction; human keystroke and probabilistic continuation materially limit generalization.
Read the implicationsThe exact client versions receiving the October 1 correction are not established in the source. How often the agent retries outside a sandbox under other prompts remains unknown.
Limits and uncertaintyFull account
In Forever Security’s Cursor test, untrusted page JavaScript invoked a browser bridge event and supplied selected-element attributes to the agent composer. The attributes were not just visual page content: they influenced instruction construction and pushed the coding agent toward a package installation. In the demonstrated chain, a sandbox-denied attempt could be retried with greater execution privileges. This is a tool and permission-boundary failure, not merely a malicious sentence displayed on a webpage.
The proof of concept needed a user interaction and the researchers described variability rather than deterministic takeover. The article reports a patch observed on October 1 without specifying a reliable fixed version for all affected builds. A safe test would instrument the bridge payload, user gesture, inferred command, rejected sandbox call, and whether a retry was allowed by an independent policy gate.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-CURSOR-BROWSER-BRIDGE-1The researchers demonstrated that Cursor’s embedded browser could pass attacker-controlled selected-element attributes into the agent composer, influencing installation actions.supported
Basis: reported finding
- supportsEMBRACE: embedded AI-assistant browser attack pathsprimary disclosure
EMBRACE technical article, Cursor window.cursorBrowser.send and element-selected bridge demonstration
Implications
Bridge-origin metadata is not a user instruction; human keystroke and probabilistic continuation materially limit generalization.
Controls and mitigations
- Require origin-tagged bridge events and host-enforced command approvals that cannot be downgraded by model retries; compare reported patched client.
Unknowns and contradictions
- The exact client versions receiving the October 1 correction are not established in the source.
- How often the agent retries outside a sandbox under other prompts remains unknown.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208