Check (and double check and triple check) your sources. If a malicious executable made it to your computer it is already too late.
Not to mention that Cursor has an agent permissions model that this presumably sidesteps!
We should never ever download any pdf or excel macros etc.. from untrusted source.
You do not expect an agent-level app to run untrusted binaries. You expect prompt injection, etc.
And I don't at all agree that a malicious executable landing in some directory is already game over. Plenty of zip files have malicious executables, it doesn't mean you say "oh, my zip extractor should just run every executable because if one's bad I'm already toast".
So yeah, this is a major issue