curl | sh in Cursor — agent safety guide
Cursor agents frequently attempt curl | sh during autonomous sessions.
curl | sh
Blast radius
Whatever the remote server returns at the moment of the request runs with the caller's shell privileges. A compromised TLS endpoint, a server-side hijack, a CDN edge takeover, or a DNS poisoning at the moment of execution all yield arbitrary code execution. Most installers `set -e`, so errors abort — but the malicious portion has usually already run.
Why agents reach for it
Agents reach for it when installing CLIs (`curl https://install.example.sh | sh`), bootstrapping environments, and following third-party README quick-start instructions verbatim. The risk surface is highest with typosquatted domains and unsigned binaries.
Recovery options
No technical rollback — by the time the response is in the shell's read buffer, every command has been parsed and executed. Forensic recovery: `~/.bash_history` may capture the command but not the script body; `auditd` (if enabled) logs exec calls; snapshots of the install paths may show what was added or modified.
Real-world incident
An agent piped curl into sh from a URL that had been typosquatted by one character. The script exfiltrated SSH keys and AWS credentials, modified `~/.bashrc` to install a persistent SSH key, and returned a successful exit code to the agent — the operator didn't notice for three days.
Block it with DestructGuard's strict tier
DestructGuard's strict rules tier includes curl | sh by default — the call is intercepted at the shell or process boundary before execution. Approvals are logged to JSONL with timestamp, caller, command, and decision. Pair with git pre-commit and pre-push hooks from the Pro Pack so destructive patterns are blocked at multiple points in the agent pipeline.
From guidance to an enforceable agent loop
Preflight this command before an agent executes it
Start with the one-cent Action Safety Quick Gate. Low risk can proceed, medium risk routes to full DestructGuard evidence, and high or critical risk routes to the complete workflow for ReviewQueue triage, a signed receipt, and a privacy-preserving status record. Triage never implies human approval.