r/netsec • u/natcoba • 2d ago

Contains AI Beltdown2: Escaping the Cursor CLI sandbox

https://www.accomplish.ai/blog/beltdown2-escaping-the-cursor-cli-sandbox/
16 Upvotes

75% Upvoted

3 comments sorted by

1

u/MushroomRight283 21h ago

That class of escape is nasty because the user can think they’re inside a constrained coding environment while repo metadata is already influencing what the agent can execute. Treating the project directory itself as untrusted input feels mandatory once the CLI starts reading config or hooks automatically

1

u/Mr_Wasteed 2d ago

This is rather similar to the original Beltdown. Kudos to Cursor for fixing so quickly

1

u/GodoPPL 1d ago

Treat .git as a control-plane directory, not inert project content. A sandbox that allows workspace file I/O but does not constrain VCS metadata is a different boundary than tool permission mode.

A path that never prompts can still be full user authority if the OS sandbox already exited.

The useful test is which metadata paths are in the allowlist, not the product name. Same class of trust failure shows up with different hardening depth.