Developer accidentally spends company’s entire Cursor budget in one sitting — and discovers worrying flaw that let them extend it by over $1 million

OX Security says that a lack of mandatory spending caps and overly permissive access mean it's possible to drain corporate budgets within hours

By Emma Woollacott

published 10 December 2025

in News

(Image credit: Getty Images)

A mistake by a developer at OX Security has revealed critical vulnerabilities in Cursor that could allow attackers to drain enterprise coffers.

Cursor is one of a number of highly popular “vibe coding” platforms that allows developers to build applications using AI.

According to OX Security, the developer in question accidentally spent the firm’s entire monthly budget in hours, prompting calls for more robust spending caps and guardrails.

"When he got notified of exceeding the limit, he wandered off to his user settings and found out he could simply change the organization’s budget limitations (to over $1M!) – even though he wasn’t the admin. The admin received no notification."

The mistake was possible because of a lack of mandatory spend caps and overly permissive access, with non-admins able to modify critical settings. Meanwhile, bills appeared hours or days later, making the overspend difficult to spot.

While both Cursor offers ways to limit spending, these protections are not enabled by default, are reactive rather than preventative, and depend entirely on manual configuration.

OX Security said most teams will probably assume that controls are admin-only, particularly given the statement in Cursor’s documentation that “admins can increase the limit”.

However, the default settings mean that a non-admin user can change team limits to 'unlimited', set caps to more than $1,000,000, and save changes without any pushback.

Spending limit issues have security implications

This isn’t only an admin’s headache, OX Security warned, as it's been able to build a proof-of-concept showing how attackers can exploit these weaknesses to drain millions of dollars in compute power value.

First, the attacker sends a malicious Cursor deeplink which, when clicked, automatically injects a prompt into the user’s Cursor chat, opens the Command Palette, navigates to the team Usage & Billing modal.

Thereafter, it edits the usage limit to an extremely high value and then saves it – all without requiring admin permissions. The team budget can now hit more than $1 million a month.

Crucially, a second deeplink is sent triggering an infinite requests loop to flood Cursor with high usage. This link runs code in the name of the team member, injects a prompt that triggers infinite requests and burns through tokens at scale.

Researchers warned this would cost the company up to the modified limit.

Deeper access

According to OX Security, when developer accounts are compromised or API tokens leak online, attackers gain direct access to AI compute resources.

These stolen tokens can be used directly by attackers for their own AI workloads or exploited at scale across multiple compromised accounts simultaneously – or sold on dark web marketplaces where AI access is increasingly valuable.

"Organizations using these platforms should immediately review billing settings, enable admin-only controls, and implement spending caps," said the firm.

"This wasn’t just a configuration oversight. It exposed a systemic problem: AI platforms prioritize speed and access over protection, creating an environment where a single leaked token or malicious link can trigger unbounded usage – silently driving costs into the millions before any alert fires."

Amazon Bedrock claims questioned

Notably, OX Security claimed Amazon Bedrock also has similar issues. While the firm said the platform has no built-in spend caps by default, customers do have access to AWS Service Quotas and cost controls via AWS Budgets.

In a statement given to ITPro, a spokesperson for AWS said: "This is not a security issue with Amazon Bedrock or AWS. AWS customers who want to manage spending in Amazon Bedrock can do so through AWS Service Quotas and cost controls like AWS Budgets.

"Access to Bedrock APIs and the ability to modify service quotas are governed by IAM permissions, which customers configure based on their security requirements."

Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.

MORE FROM ITPRO

Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.