AI’s Open Secret: Why Your Cursor Extensions Can Silently Siphon Your API Keys

LayerX researchers disclosed a high-severity (CVSS 8.2) vulnerability in the Cursor AI code editor: Cursor stores API keys and session tokens unencrypted in a local SQLite database (~/Library/Application Support/Cursor/User/globalStorage/state.vscdb), and any installed extension can read and exfiltrate those secrets silently. The proof-of-concept shows malicious extensions can locate the DB, query for secrets, and send them to an attacker-controlled server with no user interaction; Cursor acknowledged the finding but treated it as within the user's trust boundary and had not fixed it as of April 28, 2026.