Does Cursor introduce security vulnerabilities?

Research on AI code assistants, including studies published by Stanford and NYU, has found that developers using AI code generation tools produce code with more security vulnerabilities compared to writing code manually. Cursor can introduce issues like SQL injection through string concatenation, cross-site scripting via unsanitized output, and insecure deserialization. The AI may also suggest deprecated cryptographic functions or insecure random number generators. These vulnerabilities are often subtle and pass functional testing while remaining exploitable. UNPWNED checks externally observable exposure, configuration, dependency, endpoint, form, and error-disclosure signals. Internal code flaws still require code review, SAST, or targeted testing. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.