1.2.4 - Agent auto-updated to 1.3, auto-turned on "auto-run" mode, didn't turn on delete protection, deleted files without asking

Bug Reports
1

Describe the Bug

I was updated to a beta branch I didn’t ask for (huge breach of user trust, but not what the post is about). In using it–before I realized–it asked if I wanted to “allow-list” some commands like “find” and “sort”. Sure, I said! What could be the harm? Well, it turns out that in doing this, it automatically turned on “Auto-Run Mode” and did NOT turn on “File-Deletion Protection”.

  1. Why was I upgraded to a beta branch? Y’all have apologized but you haven’t explained how it happened or given us reason to believe it won’t happen again. This is an insanely vulnerable place for users to be. The bug today caused working code that had not yet been committed to be deleted without any user prompting, what will the bugs do tomorrow? I need more confidence that I will remain on stable branches unless I choose otherwise.
  2. Why on earth is “File-Deletion Protection” not on by default when you turn on auto-run mode?
  3. Why on earth is it not explained that “Auto-Run Mode” will be turned on when I allowlist a command via the pop-up prompt in 1.3?
  4. What sort of reconciliation can we expect? This has cost me a huge chunk of my day and eroded trust and confidence in moving quickly with Cursor.

Steps to Reproduce

I can’t even begin to imagine how this bug occurred. It’s a series of bugs / odd design choices.

Expected Behavior

  1. A user should be notified if a setting within cursor is going to be changed and what the other implications are.
  2. Toggling settings should NEVER cause the agent to be able to auto-delete files unless the setting being changed explicitly and exclusively relates to allowing auto-delete.
  3. A user should NEVER be given an experimental branch when they’re not signed up for it.

Operating System

Windows 10/11

Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.2.4 (user setup)
VSCode Version: 1.99.3
Commit: a8e95743c5268be73767c46944a71f4465d05c90
Date: 2025-07-10T17:09:01.383Z
Electron: 34.5.1
Chromium: 132.0.6834.210
Node.js: 20.19.0
V8: 13.2.152.41-electron.0
OS: Windows_NT x64 10.0.19045

Additional Information

I’m not sure how to continue using Cursor with the trust I once had for it. Being thrown onto beta branches, new features causing auto-deletions to be enabled, and no clear explanation from the Cursor team as to how any of this happened is wildly concerning. I was just starting to get really comfortable here, too.

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

2

Hey, sorry about that. We’re releasing an update soon that should fix this issue. In the meantime, you can switch to the previous version. You can download it here:

3

Hey @deanrie, thanks for the quick response. I’m sure you guys are dealing with plenty of headaches today. I had already rolled back to 1.2, but the “Auto-Run” feature remained enabled so 1.2 was auto-deleting files without permission because of the way 1.3 handled the allow-list pop-ups. Just wanted to make it clear that this isn’t just the issue everyone is having with being pushed forward… The issue is that one of the new features had a negative impact that carried over into the rollback.

Thanks,
Dak

4

Thanks for the additional info. Did you continue working in the same chat or did you create a new one?