hey!! :33

so i was poking around inside the cursor editor internals (specifically the Everysphere shell-exec subsystem) and found this standalone binary called cursorsandbox.

its a rust-based sandbox helper that cursor uses to run its ai-generated commands safely. but the funny part is... you can just pull it out and use it yourself lol

how does it work??

its cross-platform:

• macos: uses apple seatbelt (literally sandbox-exec under the hood)
• linux: uses bubblewrap (bwrap)

but it doesnt just block filesystem access. it actually intercepts all network traffic and forces it through its own unix sockets...

policy.json

the binary expects a policy file in json format. thanks to some leftover serde strings in the binary, i restored the exact structure:

{
    "version": 1,
    "networkPolicyStrict": false,
    "sandbox": {
        "type": "workspace_readwrite",
        "cwd": "/tmp",
        "additionalReadwritePaths": [
            "/tmp"
        ],
        "additionalReadonlyPaths": {
            "/etc": []
        },
        "networkAccess": true,
        "disableTmpWrite": false,
        "blockGitWrites": true,
        "ignoreMapping": {}
    }
}

note: policy.json gets deleted immediately after launch, so back it up somewhere...

blockGitWrites: true

this is hilarious. if this is true, the sandbox hardcodes a seatbelt rule (deny file-write* (regex "^.*/\\.git/hooks($|/.*)")). it explicitly blocks the ai from sneaking malicious scripts into your git hooks, and also protects .vscode and .cursor folders

network strict mode

if "networkPolicyStrict": true is set, the sandbox goes full authoritarian:

1. it spins up its own local proxy (http and socks5) via --run-socket-forwarder
2. it intercepts everything by forcefully injecting environment variables into the sandboxed process: HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, socks5_proxy, GIT_HTTP_PROXY, etc
3. it sets __CURSOR_SANDBOX_ENV_RESTORE to backup the original variables, probably so child processes can know what the real network looked like

using it outside cursor

you can literally use this as a lightweight docker alternative on macos to run sketchy scripts:

./cursorsandbox --policy policy.json -- bash -c "echo 'haii from inside the box :3'"

theres also a --preflight-only flag that just tests if the sandbox profile can be generated without actually running anything

some conclusions idk

cursor ships a really solid, standalone rust sandboxing tool that you can just steal and use for your own tools idk......

mreoww :3