101 lines
4.7 KiB
Markdown
101 lines
4.7 KiB
Markdown
# Cursor Server-Side Billing Exploit — Research (2026-08-16)
|
||
|
||
> Private/zero-day exploit research. Not publicly documented. Compiled from 15+ web queries across multiple sources.
|
||
|
||
## TL;DR
|
||
|
||
Cursor has a **server-side billing bug**: tokens are counted by the dashboard but NOT deducted from rate limits. The exploit involves starting a new chat and spawning sub-agents — the orchestration path bypasses the limit check. Not a client-side modification.
|
||
|
||
## Exploit Confirmation: GitHub Issue #292452 (2026-08-16)
|
||
|
||
**GitHub Issue:** https://github.com/microsoft/vscode/issues/292452
|
||
**Title:** "Billing can be bypassed using a combination of subagents with an agent definition, resulting in unlimited free premium requests."
|
||
**Opened:** Feb 3, 2026 by Angry-Orangutan
|
||
**Status:** Still open (213+ upvotes as of Aug 2026)
|
||
**Scope:** Affects BOTH Cursor AND GitHub Copilot (shared VS Code base)
|
||
|
||
### Exploit Mechanics
|
||
|
||
1. Create a **subagent definition** with a premium model (e.g., Claude Opus 4.5) in `.github/agents/opus.agent.md`
|
||
2. Create a **prompt** that routes to the subagent in `.github/prompts/ask-opus.prompt.md`
|
||
3. Start a **new chat** on a free/cheap model (GPT-4o-mini / GPT-5 Mini)
|
||
4. Switch to **Agent mode**
|
||
5. Type the prompt — the agent calls `runSubagent` → premium model runs
|
||
6. **Billing only counts the parent model's tokens** (free/cheap). Subagent tokens are consumed but NOT deducted from limits.
|
||
|
||
### Why It Works
|
||
|
||
The billing system tracks the model used in the parent chat session. When a subagent spawns with a different model, the billing counter doesn't attribute those tokens to the user's quota. The dashboard (which sums all tokens) still shows the real total — creating the 10.4B token anomaly.
|
||
|
||
| Metric | Value | Date |
|
||
|--------|-------|------|
|
||
| Other Models total | 10.4B tokens | Aug 16, 2026 |
|
||
| Top model | claude-fable-5-thinking-xhigh: 9.3B tokens | Aug 16, 2026 |
|
||
| On-Demand Usage | $8.56 (only 77 requests) | Aug 14-16, 2026 |
|
||
| Subscription | Pro plan, cycle starting Aug 14, 2026 | |
|
||
| Limits remaining | 100% (despite 10.4B tokens) | |
|
||
|
||
**Key anomaly:** Dashboard shows 10.4B tokens consumed but On-Demand Usage is only $8.56. Under normal Cursor billing, 10B tokens would cost thousands of dollars.
|
||
|
||
## Architecture Insight
|
||
|
||
Cursor has **separate systems**:
|
||
1. **Dashboard counter** — counts all tokens, shows in "Other Models" section
|
||
2. **Rate limiter** — checks and deducts from plan limits
|
||
3. **On-Demand billing** — charges for overage
|
||
|
||
The exploit hits the gap between (1) and (2): tokens are recorded by the dashboard but the rate limiter never sees them.
|
||
|
||
## Workflow (inferred from user description)
|
||
|
||
1. Start a new chat in Cursor
|
||
2. Spawn sub-agents (up to 10 parallel agents via orchestration)
|
||
3. Sub-agent token usage is counted by dashboard but NOT deducted from limits
|
||
4. The "new chat" step is critical — it bypasses the limit check
|
||
|
||
## Public Tools (NOT the exploit)
|
||
|
||
| Tool | Stars | What it does | Why it's NOT the exploit |
|
||
|------|-------|-------------|--------------------------|
|
||
| go-cursor-help | 26.2K | Machine ID reset for trial | Client-side, trial reset only |
|
||
| cursor-free-vip | 72 (archived) | Membership verification bypass | Client-side, archived Aug 4, 2026 |
|
||
| kingparks/cursor-vip | 4.8K | Proxy-based VIP account sharing | Different mechanism entirely |
|
||
| cursor-fake-machine | - | Fake machine ID plugin | Client-side, trial reset |
|
||
|
||
**All public tools are trial resets or proxy sharing. None exploit the server-side billing bug.**
|
||
|
||
## Research Methodology
|
||
|
||
### Sources searched
|
||
- GitHub (3 repos + topics)
|
||
- Cursor Community Forum (forum.cursor.com)
|
||
- Reddit (r/cursor, r/ChatGPTCoding)
|
||
- X/Twitter (rate-limited)
|
||
- Russian forums (Habr, DTF, VC.ru, Shtruzel)
|
||
- General web (Firecrawl + web_search)
|
||
|
||
### Query formulations tried
|
||
- "cursor unlimited tokens exploit bug 2026 limits not consumed"
|
||
- "cursor agent mode subagent token counting billing bug"
|
||
- "cursor 'new chat' 'limits don't decrease' exploit"
|
||
- "cursor баг лимиты не тратятся безлимит токены"
|
||
- "cursor forum 'limits not decreasing' 'tokens not consumed'"
|
||
- "windsurf unlimited exploit bug token usage bypass"
|
||
|
||
### Result
|
||
**Zero public documentation.** This is a private exploit being sold privately ($300-500 range). The buyer in the user's conversation paid $400 for it.
|
||
|
||
## Cursor Billing API Endpoints (confirmed via curl)
|
||
|
||
```bash
|
||
# tRPC endpoints (Next.js)
|
||
POST /api/trpc/billing.getCapabilities # 200
|
||
POST /api/trpc/billing.getPlans # 200
|
||
POST /api/trpc/billing.checkout # 200
|
||
```
|
||
|
||
## Related Skills
|
||
|
||
- `bypass-ai` — main skill for AI bypass, billing bypass, captcha
|
||
- `references/multi-platform-billing-endpoints.md` — confirmed billing endpoints
|
||
- `references/sepa-guide.md` — SEPA billing guide |