Misbehavior1 sourceFirst seen
A Silent Google Doc Share Turned Cursor Into a Remote Code Execution Buffet
Ourtake
Your AI coding assistant read one document and handed over the keys. Nobody clicked anything, which is somehow worse.
What happened
Lakera researchers demonstrated a zero-click attack in which a malicious Google Doc silently shared with a developer led Cursor, with a Google Docs MCP server and Python execution allow-listed, to fetch and run a payload from a GitHub Gist. The demo harvested secrets and installed a persistent reverse shell. The researchers say the chain relies on intended agentic features rather than a patchable bug.