Why does widening an agent's network access, whether through Allow All in the sandbox or an MCP server that fetches arbitrary URLs, materially change the impact of a prompt-injection attack?

The principle — With default settings, Cursor's first-party tools make network requests only to GitHub, direct link retrieval and web search providers. Agents cannot make arbitrary network requests. That narrowness is a deliberate control rather than a limitation waiting to be lifted.

Why the key is correct — Prompt injection needs an outbound channel before it is worth running. Hidden instructions in a fetched page, a dependency file or a code comment can steer an agent, but the attacker's payoff is your source, your environment variables or your credentials arriving on a host they own. A default agent has no way to send them anywhere. Enabling Allow All network access, or connecting an MCP server that will fetch any URL on request, supplies precisely the channel that was missing, and it does so for every future run rather than the one that motivated the change.

Why the others are wrong — Assuming agents already reach any URL makes the widening look free, when in fact it is the single change that converts a hijacked agent from noisy to damaging. Writes outside the workspace are a genuine risk with their own protection, but data written to another directory has still not left the machine. And network policy does not touch the classifier; the two controls are configured separately and apply independently.

Remember this — Ask what an injected instruction could achieve with the tools currently enabled. Once the answer includes reaching an arbitrary host, the guardrail that mattered most is already gone.

Sources — Cursor's Agent Security documentation.