Security fixes are applied to the main branch and the latest GitHub Release.

Please report security issues privately to security@axlabs.com (or via GitHub Security Advisories on this repository). Do not open public issues for vulnerabilities that could enable remote code execution, privilege escalation, or credential theft.

Include:

• Affected version / commit
• Reproduction steps
• Impact assessment

cursor-agent-service installs and supervises Cursor’s agent worker start process. That worker can execute local tool calls (shell, filesystem, browser, MCP) with the privileges of the configured OS user when Cursor Cloud Agents assign work.

Operators should:

• Run as a non-root user
• Limit the configured workspace to the repository that must be accessible
• Treat Cloud Agent prompts and tool results as untrusted automation
• Review Cursor’s own agent security and terms
• Prefer checksum-verified installs and inspect install.sh before piping to bash

This project never intentionally logs or stores Cursor API keys or login tokens in its config files.