Cursor

Overview

Cursor is an AI-powered code editor startup specializing in AI-first development workflows. Co-trained grok 4.5 with spacexai — first jointly built model beyond software engineering.

Grok 4.5 Partnership (July 2026)

• Joint MoE training with spacexai; Grok 4.5 default across all Cursor plans (2026-07-09-grok-45-cursor-blog)
• Pricing: $2/$6 per M tokens; double usage first week
• CVE-2026-50549 GhostApproval fix in v3.0 (2026-07-09-ghostapproval-wiz-primary)

Funding and Valuation

• 2026-04-19: Raising $2Bat$50B+ valuation (pre-money).
• 2026: Annualized revenue of $2B(Feb2026);forecast$6B+ run rate by year-end.
• Co-leads: Andreessen Horowitz (a16z), with nvidia and Thrive Capital participating.
• Previous rounds: $2.3B(Nov2025,$29.3B valuation); $900M (June 2025).

Market Position

Cursor’s mega-round reflects investor enthusiasm for specialized ai-code-assistance tools. While github-copilot dominates via GitHub’s installed base, Cursor has captured developer preference through:

• IDE-first design (native editor)
• Advanced agent capabilities with terminal execution
• MCP integrations for external tools (sentry, etc.)
• Rapid iteration cycles

2026 Security Exposure

Agentjacking (June 2026)

Tenet Security confirmed Cursor vulnerable to agentjacking — fake sentry errors injected via public DSN cause Cursor agents to execute attacker-controlled npm packages. Part of 85% success rate across tested agents.

Miasma Worm (June 2026)

miasma-worm campaign targets Cursor as auto-execution trigger when opening compromised repos.

Mitigation Guidance

• Restrict MCP connector permissions; treat observability data as untrusted
• Require human approval for terminal commands and package installs
• Do not open unverified repos in Cursor agent mode

Recent Developments

• 2026-07-14: mindgard full-discloses Windows cursor-git-exe-rce (workspace git.exe auto-exec); reported Dec 2025; last verified Cursor 3.2.16 Apr 30 (2026-07-17-cursor-git-exe-mindgard-primary)
• 2026-07-16: Cited as former ~50% revenue customer of fireworks-ai before diversification (2026-07-17-fireworks-series-d-cnbc-corroboration)

Related

• ai-ide-supply-chain-security

• untrusted-search-path

• github-copilot

• agentjacking

• ai-agent-security

• ai-coding-tools

• model-context-protocol

• developer-tools

• venture-capital

Sources

• 2026-07-17-cursor-windows-git-exe-rce-unpatched

• 2026-04-19-cursor-ai-2-billion-funding

• 2026-06-10-agentjacking-tenet-security-primary

• 2026-06-05-miasma-microsoft-stepsecurity