Cursor breaks the normal trust boundary at project open. A folder can carry a binary at the repository root, and Cursor will execute it as the signed-in Windows user just from loading the project, so the repository itself becomes the dropper.
Mindgard says Cursor looks for Git binaries in the workspace and will run a repo-root `git.exe` without warning or approval. The result is arbitrary code execution with the developer’s source, SSH keys, and cloud tokens still in reach, and the code can keep re-triggering as long as the project stays open.
That matters beyond one editor. Any tool that auto-discovers helpers from project contents can inherit the same failure mode, and seven months after the December 15 report Cursor still has no patch or advisory, with Mindgard’s latest confirmation landing on current builds.