Proofpoint Shows How Cursor MCP Deeplinks Can Enable User-Approved Code Execution

Summary

Proofpoint researchers demonstrated in controlled tests how social engineering and user approval of a Cursor MCP deeplink could enable command execution or installation of a malicious remote MCP server. The tests did not show a default zero-click path.

Key points

The Cursor protocol handler accepts deeplinks containing base64-encoded MCP configurations that can add entries to the user's mcp.json file.
In the proof of concept, a phishing link redirected users to a malicious deeplink; accepting Cursor's install prompt could trigger a configured command.
The command-based path staged a batch script that downloaded and executed a Metasploit payload, establishing a Meterpreter session.
A separate URL-based path could socially engineer users into installing a malicious remote MCP server.
The observed install dialog showed the same warning for legitimate and malicious deeplinks; outcomes depend on user permissions, configuration, and enterprise controls.
Proofpoint said it observed no silent zero-click path in the tested default configurations; tests were conducted in a controlled environment.
Suggested mitigations include stricter permissions or containerization, verified MCP publishers, and treating deeplinks from untrusted sources cautiously.

Article Details

Attack Vectors: A phishing email directs the user to a landing page that redirects to a crafted cursor:// deeplink containing a base64-encoded MCP configuration.
After the user clicks the deeplink and accepts Cursor's installation prompt, the configuration can execute a command with the user's privileges or add a remote MCP server.
In the proof of concept, the command downloads run.bat, which retrieves and executes a Metasploit payload (p.exe); the payload establishes a Meterpreter session with the attacker's listener.
The article describes this as a proof of concept tested in specific environments; it reports no silent or default zero-click path.
Defensive Notes: Treat deeplinks from untrusted sources like untrusted executables; verify their origin and review configuration parameters before approval.
Use granular permissions or containerization to isolate MCP server execution, and consider signing and verified publishers for MCP servers.
EDR, allow-listing, and operating-system policies may limit or block abuse depending on configuration.
Use strict allow-listing and content inspection to reduce risks from staged or embedded payloads.