cursor-agent-v0.4.2 is a sub-binary of the Cursor AI coding assistant, downloaded directly from GitHub without going through an official package registry. It carries no verified publisher signature, making it impossible to confirm its origin or integrity through standard channels. This binary has been observed accessing AWS credential files (~/.aws/credentials), SSH private keys (~/.ssh/id_rsa), and browser session token caches across 47 Finova endpoints — access patterns that extend well beyond what a coding assistant requires. While Cursor AI is a widely-used legitimate development tool, this specific sub-binary was introduced in version 0.42 and its file access behavior matches previously documented patterns in supply chain compromise incidents. Our behavioral scan flagged 2 non-conclusive indicators. Immediate recommendation: apply zero trust file control to restrict this binary to its working directory, and investigate the 3 external IP addresses it contacted outside Cursor's known infrastructure.