I don't know about Cursor, but VSCode can be used from Chrome, which has a good sandbox against an attacker's exploiting VSCode to get access to the system you are running Chrome on.