Cursor AI code agent leaking repository secrets via context window
Date: 2025-03
Affected: Cursor AI users — developers using AI code assistance on repositories containing secrets; any AI code agent with full-repo context indexing
Attack vector: other
Category: real-world
Severity: High

Users of Cursor AI (an AI-powered code editor) reported that the agent's context window inadvertently included sensitive files (.env, credentials, private keys) when generating code suggestions or answering questions about codebases. The AI agent, which indexes the entire repository for context, did not distinguish between files meant for AI context and files containing secrets. In several reported cases, the AI included credential values in its responses, which were then visible in shared Cursor sessions or logged by telemetry. The incident highlights the tension between broad context windows (needed for useful code assistance) and secret exposure (any file in the repo becomes potential model input).

Impact: Secret exposure via AI context window; credentials visible in shared sessions and telemetry logs; applies to all AI code agents (Copilot, Cody, Continue) that index full repositories

Mitigations:
Context window filtering: exclude files matching .gitignore, .env*, *.pem, *.key patterns
Secret detection scan on context before model submission
Agent permission model: explicit opt-in for sensitive file access
Telemetry scrubbing: redact secrets from logged AI interactions

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: Agent framework indexes all files without secret filtering
role: origin
label: Data Operations
notes: Secrets flow from repository into model context as data
role: propagation
label: Evaluation & Observability
notes: No monitoring of what files are included in agent context
role: blind-spot
label: Security & Compliance
notes: No DLP on agent context window content
role: blind-spot