Windsurf AI Security Risks — and What Windsurf Actually Is Now

Windsurf is usable for professional work, but not safe by default. Since October 2025, three vulnerabilities have been published against it in the US National Vulnerability Database. One is rated 9.8 critical and can be triggered by text hidden in the files you open. Its current terms also allow training on your data by default unless you opt out. Below are the risks, what the certifications do and do not cover, and a short checklist to use it safely.

Contents

• ·Is Windsurf safe to use?
• ·Which Windsurf vulnerabilities have been disclosed?
• ·Does Windsurf train on your code?
• ·What do SOC 2 and FedRAMP actually cover?
• ·How do you use Windsurf safely?
• ·What is Windsurf, and who owns it now?
• ·Frequently Asked Questions

Is Windsurf safe to use?

Yes for most teams, after you change three defaults. The risk is not that Windsurf is unusually careless. It is that an AI agent that can read files, run commands and browse the web gives attackers a new way in: prompt injection. An attacker hides instructions in content the agent reads, such as a README, a web page or a file name, and the agent follows them. OWASP ranks prompt injection as the number-one risk for LLM applications.

That makes your exposure depend on three things:

• ·What the agent can reach. Secrets in .env files and SSH keys sit in the same file system it can read.
• ·What it can do without asking. Auto-run and "turbo" modes remove the approval step for terminal commands.
• ·What it reads. Cloned repositories, web pages and third-party MCP tools all count as untrusted input.

Which Windsurf vulnerabilities have been disclosed?

Three are on record in the National Vulnerability Database, all involving prompt injection or file access:

The pattern matters more than any single bug. Each one turns *content* into *action*. The most serious, CVE-2025-62353, is described as affecting all versions at the time of publication. The 2026 entry needed no click from the user beyond processing attacker-controlled HTML. Keep the editor updated, and treat any repository or web page you let the agent read as code you are about to run.

Does Windsurf train on your code?

By default, yes, unless you are on Enterprise. Windsurf's security terms now live in the Devin documentation. They state that "by default, we may use your data for model training purposes", and that paid users can opt out on the Data Controls page. Opting out also switches on zero data retention with the model providers. On Teams plans, only an administrator can opt out. Enterprise customers are covered by a stronger promise: no training without express prior written consent.

What to do with that:

1. 1.If you are on a paid self-serve plan, open Data Controls and opt out before you open client code.
2. 2.On a team, confirm an admin has done it for the whole workspace.
3. 3.Treat the free tier as unsuitable for proprietary or client code.

What do SOC 2 and FedRAMP actually cover?

They certify the company's controls, not the editor's resistance to prompt injection. Cognition, which owns Windsurf, says it has been SOC 2 Type II certified since September 2024. In March 2025, Windsurf Extensions received FedRAMP High authorization; those are the editor plugins, previously Codeium. Both are meaningful for procurement. Neither would have stopped the CVEs above, which were bugs in how the agent handled untrusted content.

How do you use Windsurf safely?

Change the defaults before the first real project. This checklist covers the risks above:

• ·Update to the latest release, and check the release notes against each CVE entry; the database lists which versions each one affects.
• ·Opt out of training in Data Controls, or use an Enterprise contract.
• ·Require approval for terminal commands; switch off auto-run and turbo modes.
• ·Keep secrets out of the workspace. Use a secrets manager instead of .env files the agent can read.
• ·Vet MCP servers before adding them, and review the MCP config file after opening unfamiliar repositories.
• ·Open untrusted repositories in a container or a throwaway environment, not your main machine.

Our view: these are the same steps you would take with Cursor, Claude Code or any agentic editor. Windsurf is not uniquely dangerous; it simply has the most visible public record of what goes wrong.

What is Windsurf, and who owns it now?

Windsurf is an agentic coding editor built by the team behind Codeium. In July 2025, Cognition, the maker of the Devin coding agent, agreed to acquire Windsurf. At the time Windsurf had about $82M in annual recurring revenue and 350+ enterprise customers. This came after a separate deal moved its CEO to Google. Cognition now markets the editor as Devin Desktop, and windsurf.com redirects to devin.ai/desktop (checked 11 October 2026).

For builders, the revenue question is about *users*, not the tool. The ProvenStartups index lists Windsurf itself as a scale reference. It also lists one large company that names Windsurf in its build: Cluely, which reports about $500K/mo (founder-reported). That is too little to claim Windsurf users out-earn anyone. For revenue evidence by tool, compare 59 apps built with Claude Code and 146 vibe coded apps.

Frequently Asked Questions

Is Windsurf safe to use for work code?

It can be, once configured. Windsurf has had three published vulnerabilities, including a 9.8 critical path-traversal flaw reachable through prompt injection, and current terms allow training on your data by default. Update to the latest version, opt out of training, keep secrets out of the workspace and require approval for terminal commands.

Does Windsurf store or train on my code?

Under the current Devin and Windsurf security terms, data may be used for model training by default. Paid users can opt out in Data Controls, which also enables zero data retention with model providers. Enterprise customers are only trained on with express prior written consent.

Is Windsurf SOC 2 compliant?

Cognition, which owns Windsurf, states it has been SOC 2 Type II certified since September 2024. Separately, Windsurf Extensions received FedRAMP High authorization in March 2025. SOC 2 covers the company's controls; it does not prevent prompt-injection bugs in the editor itself.

What is CVE-2025-62353?

A path-traversal vulnerability in Windsurf, rated 9.8 critical, published in October 2025. It lets an attacker read and write arbitrary local files inside and outside your project. It can be triggered through indirect prompt injection, for example instructions hidden in a repository's files.

Is Windsurf the same as Devin Desktop?

Cognition acquired Windsurf in July 2025 and now markets the editor as Devin Desktop; windsurf.com redirects to devin.ai/desktop. The security documentation has moved to Devin's docs, so check the current terms there rather than older Windsurf pages.