Of course, that ship has long sailed, for all major IDEs. Heck, VSCode SSH and devcontainer remotes allow RCE by design.
Check (and double check and triple check) your sources. If a malicious executable made it to your computer it is already too late.
Not to mention that Cursor has an agent permissions model that this presumably sidesteps!
We should never ever download any pdf or excel macros etc.. from untrusted source.
So yeah, this is a major issue
You do not expect an agent-level app to run untrusted binaries. You expect prompt injection, etc.
And I don't at all agree that a malicious executable landing in some directory is already game over. Plenty of zip files have malicious executables, it doesn't mean you say "oh, my zip extractor should just run every executable because if one's bad I'm already toast".
how is that different from the good old days of
wget ftp://ftp.something.org/software-2.10.tar.gz
tar zxfv
./configure
make
sudo make install
?Also, there's a convention or social-contract that everyone who downloads 2.10 ought to get precisely the same thing. This provides a foundation for other facets of security, like "it must have an expected hash" or "it must validate as signed by this public key". Also investigative actions like discovering when something suspicious got added, or detecting that the installer is trying to access the internet when it really shouldn't be.
Diabolical idea. Anyone know if there's been anything in the wild that did this?
"Make things as simple as possible, but no simpler." - commonly known quote.
We're making things so simple, the users don't get to have a proper chance at learning what's happening. Training people away from giving programs access, makes it opaque and dangerous. Unfortunately at the same time for non technology inclined users even Windows approach of file->Properties->Security visual UI proves challenging.
Also the archive probably won’t go and fetch a bunch of other scripts and run them (probably…) while doing so is usually the script’s primary purpose. So you’re not just trusting the people who published the script, at the time they published it. You’re trusting them and everyone they trust to still be good actors now.
That’s different to it being the standard way to install self-published bundles of scripts from all over the internet.
In any case, the curl|bash from a website is way worse as it leaves no trace. Here, you have an artifact, and multiple steps, so the probability that an issue can be detected is higher and when someone gets compromises one has a change to figure out what happened and warn others. (so good practice to copy the file somewhere else). People look at this only from purely "can I get compromised" perspective, but overlook this community aspect.
Containers are really good now, there's zero reason why every extension and LSP isn't containerized.
Also agents inside a container. It's very nice because I have zero trust for harness permission systems. But again, why aren't the tools designed from the ground up to be containerized?