Rank, 14 days: 2 on the Cursor sheet
2 people reported
All time, since Nov 1.
Agent worker key in argv
“So the key is effectively exposed to everything local.”
Is this your bug? What gets counted gets fixed. Pile on.
Paste this into your agent. It files your report, with your error and version.
I hit this bug: rapsheet.dev/sheets/cursor/issues/23964/file Follow it to file my report. Show me the text before you send.
No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends
Agent worker API key exposed in process command-line arguments. The worker is launched with the key as a plain argument (--api-key crsr_...), visible to other local processes, and keeps running after Cursor is quit.
Is this your bug?
File my report- Where
- cursor-agent-worker
- Platforms
- Linux, macOS
- How bad
- Security risk: something exposed, or done without permission.