The approval gate that only checked half the cases (2025)

The system

Cursor, an AI-powered code editor, gates certain file operations behind user approval when its agent wants to touch security-sensitive files, such as editor dotfiles like .vscode/settings.json. Settings files like this can control the shell the editor launches, among other configuration that affects what code actually runs.

What was observed

GHSA-vqv7-vq92-x87f (CVE-2025-54130, CVSS 7.5), disclosed 2 August 2025, showed that Cursor's agent could write to these sensitive files without triggering any approval prompt at all, under one specific condition: the file did not already exist.

Stop and think

1. Cursor's approval gate was designed to protect sensitive dotfiles. What is the difference between "editing an existing file" and "creating a new file at the same path," and why might a security control only check one of those?
2. If an attacker can get arbitrary text into the agent's context (through a chained prompt injection elsewhere), and the agent can write .vscode/settings.json with no approval, what is the shortest path from that to running arbitrary commands?
3. Is the interesting part of this vulnerability the injection that gets attacker instructions into the agent's context, or the approval gate itself? What does your answer imply about where you'd spend limited security budget?