1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Windsurf concentrates risk in its unsandboxed tool execution, unrestricted file-system access, and demonstrated exfiltration channels that persist through the auto-invoked memory system.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Windsurf sits in the upper risk band with agent-specific CVEs anchoring every high-scoring surface and a defense floor that contributes almost nothing to the composite.
The combination of a critical-band attack surface, a high blast radius from unsandboxed host access, and a defense score that barely registers places Windsurf squarely in the high-exposure, high-capability quadrant.
Each axis is independently scored: Attack Surface and Blast Radius on a ten-point scale, Defense Controls on a fifteen-point scale, and the AIRQ composite integrates all three.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 4.41 | The composite reflects strong capability undermined by near-absent vendor safeguards on the default operator posture. [1][2] |
| Blast Radius | 8 / 10 | Unsandboxed shell plus CVE-2025-62353 path traversal to credential stores and unrestricted outbound network access. [2][8] |
| Attack Surface | 8.48 / 10 | Multiple surfaces scored at maximum by critical-severity NVD CVEs and demonstrated zero-click exploitation chains. [1][2][3] |
| Defense Controls | 2 / 15 | Terminal approval gates and enterprise audit logging are the only vendor-provided defaults; no input filtering, sandbox, or output controls ship. [14][11] |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. The dominant exposures are unfiltered multi-channel input ingestion, auto-loaded project configuration, and an MCP marketplace where installed servers inherit full tool authority.
Six of ten surfaces sit at the adjusted ceiling and four carry confirmed exploitation via agent-specific NVD CVEs or named researcher demonstrations.
Each row ties a scored surface to its strongest evidence anchor and a brief architectural description of the exposure.
| Surface | Score | Comments |
|---|---|---|
| User Input | 5 / 4 | Accepts prompts, filenames, voice, and project-file content with no input validation; CVE-2025-36730 confirmed filename injection triggers attacker instructions and invisible Unicode tag characters bypass visual inspection. [3][7][10] |
| External Data | 5 / 4 | Auto-loads project files, .windsurf/rules, README content, and fetched web pages into the reasoning loop; CVE-2025-62353 confirmed indirect injection via hidden README instructions. [2][8] |
| Memory | 4 / 4 | Auto-generated persistent memories stored without integrity checks; SpAIware demonstrated that prompt injection persists malicious instructions across all future sessions. [6][13] |
| Reasoning | 3 / 4 | Model-agnostic architecture delegates reasoning to interchangeable LLMs; Auto execution mode delegates safety judgment to the model itself creating circular trust. [15] |
| Planning | 3 / 4 | Autonomous task decomposition with auto-continue and Devin delegation; Turbo mode removes all remaining approval gates for terminal commands. [14] |
| Tool Execution | 5 / 4 | Full shell access with user privileges; CVE-2025-62353 demonstrated that path traversal bypasses the deny list and Auto Execution OFF controls entirely. [2][8] |
| Orchestration | 3 / 4 | Multi-step tool chaining with auto-continue; Devin cloud delegation; MCP servers as external orchestration endpoints without isolation. [15][12] |
| Inter-Agent | 5 / 4 | Open MCP marketplace with community servers; CVE-2026-30615 demonstrated zero-click injection that silently registers a malicious STDIO server for RCE with no user interaction required. [1][9][16] |
| Output Processing | 3 / 4 | Markdown rendering fetches external image URLs without domain allowlisting; demonstrated as a persistent exfiltration channel via memory-stored injection payloads. [6] |
| Configuration | 5 / 4 | Auto-loads .windsurf/rules from project directories; writable mcp.json; CVE-2026-30615 demonstrated zero-click config modification achieving code execution; legacy extension exposed API key to any website. [1][4][5][9] |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Windsurf ingests repository files and web pages into a reasoning loop that holds source code and credentials, then transmits bytes externally through unsanitized markdown rendering and the approval-free read_url_content tool.
Windsurf exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Project files, fetched web pages, and MCP server responses feed the reasoning loop without input filtering. [2][3]
- Sensitive data — The unsandboxed file tools reach source code, environment variables, SSH keys, and credential stores across the operator's filesystem. [2][8]
- External egress — The read_url_content tool and markdown image rendering send bytes to arbitrary external hosts without approval or domain restriction. [3][6]
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. Compromise of the Cascade agent yields full operator-level host access with unrestricted filesystem, network, and credential reach.
Four of six factors sit at maximum band, reflecting the unsandboxed host execution model with confirmed path-traversal reach beyond project scope.
Each row maps a blast factor to the specific host capability the agent holds and the evidence anchoring that reach.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 3 / 4 | Full shell with operator-level user privileges; no container, microVM, or OS-level sandbox constrains execution. [14] |
| File system access | 4 / 4 | Arbitrary read-write confirmed across the entire filesystem including credential stores via CVE-2025-62353 path traversal. [2][8] |
| Network access | 4 / 4 | Unrestricted outbound via read_url_content and terminal with no SSRF protection or domain restriction; exfiltration demonstrated. [3][10] |
| Credential access | 4 / 4 | Path traversal reaches SSH keys, API tokens in .env files, and browser credential stores without project-scope restriction. [2][8] |
| Autonomous action | 2 / 4 | Default requires terminal approval; Turbo mode (an opt-in setting that removes all confirmation prompts) is not enabled by default; file edits require acceptance before commit. [14] |
| Deployment access | 2 / 4 | Terminal can invoke deployment commands with approval; Netlify integration available via admin configuration. [15] |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. The vendor documents enterprise compliance credentials but ships no input filtering, sandbox, or output controls on the default client-side posture.
Higher scores indicate stronger vendor safeguards; Windsurf's floor reflects the gap between server-side compliance and client-side runtime protection.
Each component is scored on what ships by default in the documented configuration, not what enterprise tiers can enable.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 0 / 3 | No prompt shield, ML-based injection detection, or content validation documented for inputs reaching the reasoning loop. [11] |
| Execution Isolation | 0 / 3 | No native sandbox, container isolation, or OS-level enforcement; Cascade runs with full user privileges on the host and industry bodies recommend immediate patching. [17][11][18] |
| Action Controls | 1 / 3 | Human-in-the-loop approval for terminal commands by default, but Turbo mode and the approval-free create_memory and read_url_content tools constitute a single-step bypass path. [14] |
| Output Guardrails | 0 / 3 | No DLP, credential redaction, or URL sanitization documented; markdown image rendering confirmed as an exfiltration channel. [6] |
| Monitoring | 1 / 3 | Enterprise-tier audit logs exist; individual users receive no structured logging, anomaly detection, or SIEM integration by default. [11] |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Priority actions are deploying an external prompt shield, wrapping Cascade in a container sandbox, and restricting the MCP marketplace to an admin-controlled allowlist.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require security review of all .windsurf/rules and AGENTS.md files before trusting a new workspace — counters Configuration and External Data at adjusted ceiling.
- Configuration Enable Workspace Trust and reject untrusted workspaces by default — counters filename injection and project-file prompt injection vectors.
- Engineering Deploy an external prompt-injection classifier between repository content and the Cascade context window — counters User Input and External Data with no vendor-provided filter.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Mandate that all Cascade sessions run inside a disposable container or VM — counters Execution Isolation at zero with no vendor sandbox.
- Configuration Configure Docker or Podman as the terminal backend so shell commands execute inside a scoped container — counters full-privilege host execution.
- Engineering Build a Seatbelt or Landlock wrapper that constrains Cascade file and network access to the project directory — counters path traversal reaching credential stores.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Set organizational policy to cap auto-execution at Allowlist Only and prohibit Turbo mode — counters the single-step bypass that removes all terminal approval.
- Configuration Configure the admin-level deny list to block network-touching commands and sensitive file operations — counters unrestricted shell with approval bypass.
- Engineering Instrument a hook that intercepts create_memory and read_url_content tool calls for explicit approval — counters the approval-free execution path.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Prohibit rendering of external markdown images in organizational policy — counters the demonstrated exfiltration channel via image URLs.
- Configuration Restrict trusted domains in the IDE renderer to a closed allowlist — counters arbitrary external URL fetching through markdown output.
- Engineering Build an output proxy that strips or rewrites external image URLs before rendering — counters data exfiltration via pixel-tracking and URL-encoded payloads.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require forwarding of all Cascade tool-call logs to the organizational SIEM — counters the default absence of structured monitoring for individual users.
- Configuration Enable enterprise audit logging and configure alert rules for anomalous tool-call patterns — counters silent exploitation with no detection.
- Engineering Build behavioral anomaly detection that flags unexpected file-path access outside project scope and unusual outbound network destinations — counters path traversal and exfiltration going undetected.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- CVE-2026-30615 Zero-click prompt injection to RCE via MCP configuration modification (CVSS 8.0). Attacker-controlled HTML silently registers a malicious STDIO server that executes arbitrary commands without user interaction. Affects Windsurf 1.9544.26.
- CVE-2025-62353 Critical path traversal enabling arbitrary file read and write across the entire filesystem (CVSS 9.8). Exploitable via indirect prompt injection in project files, bypasses Auto Execution OFF and deny-list controls. Affects all versions through 1.12.12.
- CVE-2025-36730 Filename-based prompt injection causes Windsurf to follow attacker instructions and exfiltrate data via the approval-free read_url_content tool (CVSSv4 4.6). Affects version 1.10.7 with SWE-1 model. No fix released.
- CVE-2024-28120 Codeium Chrome extension leaks the user API key to any website via unchecked external messages in the service worker (CVSS 7.5). Enables impersonation on the backend autocomplete server.
- GHSA-8c7j-2h97-q63p GitHub Security Advisory for CVE-2024-28120 documenting the message-listener vulnerability in the Codeium Chrome extension service worker.
Selected Research
- Windsurf SpAIware Memory-Persistent Exfiltration Embrace The Red demonstrates that prompt injection can invoke the create_memory tool without approval, persisting malicious instructions that continuously exfiltrate data across all future sessions.
- Windsurf Invisible Instructions Prompt Injection Embrace The Red demonstrates that Windsurf Cascade interprets invisible Unicode Tag characters as instructions, enabling hidden prompt injection that remains undetectable to the developer.
- HiddenLayer SAI Advisory Path Traversal HiddenLayer security advisory documenting CVE-2025-62353 with reproduction steps showing README-based indirect injection triggering arbitrary filesystem access even with safety controls enabled.
- OX Security MCP Supply Chain Advisory OX Security documents Windsurf as the only AI IDE where MCP exploitation required zero user interaction, categorizing CVE-2026-30615 as the most severe finding in four exploitation families.
- Tenable Research TRA-2025-47 Tenable demonstrates prompt injection via crafted filename in Windsurf 1.10.7 with confirmed data exfiltration to an external webhook without requesting user interaction.
Vendor Documentation
- Windsurf Security Page The vendor security page documents SOC 2 Type II certification, FedRAMP High accreditation, zero-data retention policy, collaborative agent architecture, and deployment mode options.
- Windsurf Cascade MCP Integration Vendor documentation for MCP server integration including stdio, HTTP, and SSE transports, 100-tool ceiling, admin marketplace controls, and team whitelist configuration.
- Windsurf Cascade Memories Vendor documentation confirming auto-generated workspace-scoped memories stored locally without integrity verification or write-approval requirements.
- Windsurf Terminal Documentation Vendor documentation for terminal auto-execution levels (Disabled, Allowlist Only, Auto, Turbo) with allow and deny list configuration and admin-level caps.
- Windsurf Cascade Overview Vendor documentation for Cascade agent tool calling, auto-continue, real-time awareness, and model-agnostic multi-step reasoning architecture.
Other Sources
- Groundy CVE-2026-30615 Analysis Independent analysis confirming Windsurf as the only zero-click exploit in the April 2026 MCP RCE disclosure wave, contrasting with single-interaction requirements for other IDEs.
- Community Hardening Guide for Windsurf Third-party hardening documentation confirming absence of native sandbox, demonstrated exfiltration paths, memory poisoning vulnerabilities, and unresponsive vendor security process.
- CSA Research Note on MCP RCE Cloud Security Alliance research note analyzing the MCP architectural flaw and recommending immediate patching for Windsurf users past version 1.9544.26.