So I have been running Cursor agent and it decided to invoke "cargo gnu --features " on my project. I was puzzled to see it and I allowed it to see what it would do, and to my surprise, it actually did something. But. I couldn't find anything regarding this "gnu": this is neither a real cargo subcommand, nor a project on crates.io, nor I could find it in my $PATH, nor I could invoke it myself, even though I saw this in my ps output:

 108302 ?        Sl     0:02 /home/user/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin/cargo gnu --features <feature>

So the agent actually did spawn a valid process and even gave the valid output.
I even tried to run the same exact command line, but it couldn't find the gnu subcommand, as I expected.

I am even wondering if this is a security issue now.

3 posts - 2 participants

Read full topic