Cursor Billing Anomalies, Sandboxes & Plugin Risk

Nothing exploded this week. But three smaller stories point the same direction: the tooling around AI-built apps is getting more powerful and more exposed at the same time. A Cursor user watched their account get drained by usage they didn't make. Vercel quietly gave free-tier apps a real network firewall. And the plugin ecosystem that Cursor, Codex, and Copilot all now share just got a new open standard — which means a bigger attack surface, not a smaller one.

TL;DR

• A Cursor user reported 77.4 million tokens and ~$70 in charges they didn't recognize, then got banned when they disputed it — a pattern that looks like a leaked API key or session, not a billing bug.
• Vercel's Sandbox egress firewall — network isolation that keeps secrets out of your code — is now available on the free Hobby plan, not just paid tiers.
• Agent Plugins 1.0.0 launched as an open standard for packaging MCP servers and skills across Cursor, Codex, and Copilot, right as another post warned that "remote" vs "local" tells you nothing about whether an MCP server's contract stays fixed.
• A new CVE (CVE-2026-47364) shows how a third-party SDK — Datadog's Android app — can quietly write user data into Firebase Crashlytics without anyone opting in.

Your Cursor Bill Is a Security Signal, Not Just an Annoyance

A user on r/cursor described opening Cursor after two weeks away and finding 49.9 million tokens billed against Claude 4.6 Opus and another 27.5 million against a second model — roughly $70 in charges across 55 requests they say they never made. When they disputed it, the account got banned.

We can't confirm the cause from one report. But this shape — a dormant account, a burst of expensive model usage, then a support dead-end — is what a leaked API key or hijacked session looks like from the outside. If you use Cursor, Codex, or any agent tool with a linked API key: check your usage dashboard on a schedule, not just when the bill surprises you, and rotate keys if you've ever pasted one into a shared repo, a Slack message, or a support ticket.

Vercel Locks Down the Sandbox — Free Tier Included

The more useful news this week is defensive. Vercel made its full Sandbox egress firewall available on the Hobby plan, the same network isolation that previously only protected paid production workloads. It lets you define allow-all, deny-all, or specific outbound rules for anything an agent runs inside a Sandbox, and it attaches secrets to outbound requests itself — so code running in the sandbox can call an authenticated service without the token ever touching your code.

This matters because more of the agent stack now runs through Vercel Sandbox by default: the new v0 API spins up a Sandbox for every generated app, Herdr gives Claude Code and Codex their own isolated Sandbox per agent, and Devin Outposts now runs sessions the same way. If your app or workflow touches any of these, this is a real security upgrade, not a marketing note — but it only protects you if the firewall rules are actually set, not left on allow-all.

The Plugin Supply Chain Just Got Bigger

Vercel also introduced Agent Plugins 1.0.0, an open, vendor-neutral standard for packaging Agent Skills and MCP servers into portable plugins that Cursor, Codex, GitHub Copilot, and ChatGPT can all load. Portability is good for developers. It's also more surface area to vet, and standards don't come with a built-in trust layer.

That gap showed up the same week in a separate post on r/cursor arguing that "remote" vs "local" tells you nothing about whether an MCP server's contract stays put — a remote server can change what it does on the far end without you knowing, and a local one can be edited by anything with filesystem access. As plugins get easier to install across more agents, treat each one like a dependency: know who publishes it, what it can reach, and whether you'd notice if its behavior changed.

Also Worth Watching: A Firebase Crashlytics CVE

CVE-2026-47364 isn't a Firebase vulnerability — it's a reminder about what flows into Firebase from other SDKs. The issue: versions of the Datadog Android app prior to v545-5.9.2 tagged Crashlytics data with the user's Datadog UUID, with no user-facing opt-out, making that UUID visible inside Firebase Crashlytics. The UUID itself isn't identifying outside Datadog's systems, but it's a useful example: your Firebase project can end up holding data you didn't put there directly, written by a third-party SDK you added for something else entirely. Worth a scan of what's actually landing in your Crashlytics or Analytics data, not just what you configured.

FAQ

Is it normal for Cursor to show unrecognized token usage?

No. Usage should track requests you or your team actually made. If you see a spike after a period of inactivity — as one r/cursor user reported with tens of millions of tokens across 55 requests — treat it as a possible key leak: rotate your API key, check where it's been shared or committed, and review connected integrations before you keep working in that account.

Should I trust a remote MCP server just because it's labeled "remote"?

Not on its own. As pointed out in the r/mcp/r/cursor discussion this week, "remote" only tells you where the server runs — it says nothing about whether the provider can silently change what the server does after you've connected it. Check who maintains it and whether it has a track record before wiring it into an agent that can touch your codebase or data.

Does Vercel's sandbox firewall protect apps built with tools like v0 or Bolt too?

It protects anything running inside a Vercel Sandbox — which now includes v0's API-generated apps, Herdr's agent sessions, and Devin Outposts. If your builder or agent workflow runs through Vercel Sandbox, the firewall is available to you on the Hobby plan now; it just needs to be configured rather than left wide open.

The Bottom Line

The infrastructure is getting safer by default — sandboxes with real firewalls, audit log drains, isolated microVMs. The risk is shifting toward accounts, keys, and the plugins you install on top of that infrastructure. Check your usage dashboards like you'd check a bank statement, and vet any MCP server or plugin the same way you'd vet a dependency, not a feature.