{"slug": "cursor-says-seven-month-unresolved-bug-is-not-its-responsibility", "title": "Cursor says seven-month unresolved bug is not its responsibility", "summary": "Cursor denied responsibility for a seven-month-old arbitrary code execution bug in its vibe coding platform, saying the issue depends on compromised or malicious input and falls outside its bug bounty scope. The platform, owned by Anysphere and used by 64% of the Fortune 500, was criticized by researchers at Mindgard for ignoring their disclosure.", "body_md": "[Security](/tag/security/)\n\nCursor has denied responsibility for an arbitrary code execution bug in its vibe coding platform after researchers said it had failed to patch the vulnerability for seven months.\n\nThe platform, bought by SpaceX for $60 billion in June, said the issue depended on a compromised or malicious input and therefore fell outside its bug bounty scope after Mindgard accused it of ignoring its [research](https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left?ref=thestack.technology).\n\nA Cursor spokesperson told *The Stack*: “We operate under a shared responsibility model for workspace and agent-context inputs: customers decide which repositories, prompts, external content, MCP servers, rules, and tools to introduce into their environment, and Cursor provides controls to help manage that trust boundary.”\n\nCursor, a product of Anysphere, has more than 50,000 enterprise customers, including 64% of the Fortune 500, according to its [ website](https://cursor.com/enterprise?ref=thestack.technology), and a\n\n[1 million+ daily active users.](https://www.cnbc.com/2026/05/19/cursor-cnbc-disruptor-50-ranking.html?ref=thestack.technology)\n\n__reported__## Get the full story: Subscribe for free\n\nJoin peers managing over $100 billion in annual IT spend and subscribe to unlock full access to The Stack’s analysis and events.\n\n[Subscribe now](https://www.thestack.technology/membership/)\n\nAlready a member? [Sign in](https://www.thestack.technology/signin/)", "url": "https://wpnews.pro/news/cursor-says-seven-month-unresolved-bug-is-not-its-responsibility", "canonical_source": "https://www.thestack.technology/cursor-says-seven-month-unresolved-bug-is-not-its-responsibility/", "published_at": "2026-07-16 11:26:45+00:00", "updated_at": "2026-07-16 11:56:05.518232+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "ai-products"], "entities": ["Cursor", "Anysphere", "SpaceX", "Mindgard", "The Stack"], "alternates": {"html": "https://wpnews.pro/news/cursor-says-seven-month-unresolved-bug-is-not-its-responsibility", "markdown": "https://wpnews.pro/news/cursor-says-seven-month-unresolved-bug-is-not-its-responsibility.md", "text": "https://wpnews.pro/news/cursor-says-seven-month-unresolved-bug-is-not-its-responsibility.txt", "jsonld": "https://wpnews.pro/news/cursor-says-seven-month-unresolved-bug-is-not-its-responsibility.jsonld"}}