A persistent Cursor browser generated high-frequency requests against my Cloudflare Worker

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cloud Agent (GitHub, Slack, Web, Linear)

Describe the Bug

I was working on a feature that runs several health checks on my website and tested it via Cursor browser using several ways (local, other machine, mobile, Cloud agents). I was emailed by Cloudflare that my worker invocations are very high, and I noticed that there are around 1k requests every 5 minutes constantly in the last 5 days from what looks to me like a Cursor agent browser. Need some help stopping this, not sure how to proceed, although I cleaned all my agents, caches, cloud agents, environments etc.

Steps to Reproduce

Not sure - looks like a stale browser.

Expected Behavior

After I deleted all my cloud agents (using API), local agent, cache, chats, requests still come in. I added a WAF rule to prevent hammering my worker but, I can still see requests coming in from that IP address.

Operating System

MacOS

Version Information

Cursor IDE: 3.20.17

For AI issues: add Request ID with privacy disabled

c1865b1eb3975c580fdd72ce2ea29837

Additional Information

Source-IP: 104.30.180.109
User-Agent: Mozilla/5.0 (X11; Linux x86_64) … Chrome/151.0.0.0 …
Signature-Agent: “https://cursorusercontent.com”
Signature-Input: sig1=(“@authority” “signature-agent”);keyid=“Vuxu4…Ub_Oo”;alg=“ed25519”;tag=“web-bot-auth”;created=1789207648;expires=1789207738;nonce=“[redacted]”
Signature: [redacted]
Cloudflare verifiedBotCategory: AI Assistant

image
image1776×326 28.6 KB

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey @rrstux, thanks for the detailed report.

Those requests aren’t coming from a Cloud Agent or the Cursor IDE browser, so deleting agents and caches wouldn’t have helped. The Signature-Agent header you’re seeing (cursorusercontent.com) is the identity of the browser inside your Grok Bot computer. When Grok Bot tested your health checks, it opened your pages in tabs in that computer’s Chrome, and those tabs stay open after the task finishes. Your health-check pages poll your Worker on their own, so the open tabs keep generating traffic while the computer runs (and it runs while the Grok Bot app is open).

To stop it:

  1. Open Grok Bot on your Mac.
  2. Open your computer view (the “Open computer” / screen button).
  3. Close every Chrome tab with your site open, or quit Chrome inside the computer.
  4. In Grok Bot, open Automations and pause or delete any routine running your health checks (one was scheduled every 5 minutes on Sep 9).
  5. If requests continue, go to Settings and use Reset Grok Bot’s Computer. This rebuilds the computer and drops all open tabs.
8

Thank you @Colin , meanwhile the requests stopped as my Cursor & GrokBot subscription stopped. You were right, GrokBot was chilling in my Dock and I haven’t noticed it, totally forgot about the army of Groks clicking around. :grinning_face: