Agent constantly overshoots simple requests and acts without guardrails

Ideas Feedback
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

The agent routinely does far more than it is asked. Scope should match the request. If I say “build me this app,” I expect it to start building. If I say “change a few files,” I expect only those files to change, then stop. Instead, a small request often turns into a coding spree: extra edits, extra files, staging, even commits I never mentioned.

I should not have to say “do only this, step by step” on ordinary tasks. I often do, because otherwise it runs like a dog that has slipped its leash. That reminder should not be required. The request itself is the scope.

I do want the agent to notice holes in my thinking and correct me. Say so, then wait. Do not “help” by charging ahead into work I did not ask for.

Steps to Reproduce

One concrete case: I asked to drop a local docs folder and point AGENTS.md at vendor library docs. I did not ask to stage or commit. The agent committed anyway. I did not invoke a commit workflow. A skill file existing on disk is not a request.

Expected Behavior

Expected: the size of the work matches the size of the ask.
Actual: one narrow request, then an unsupervised rampage, then I spend the next turn cleaning up.

Operating System

MacOS

Version Information

Version: 3.18.9 (Universal)
VS Code Extension API: 1.128.0
Commit: 2ba48ff3f7514cc4643c52ca9f7b3173d9b66130
Date: 2026-08-27T01:42:22.092Z
Layout: IDE
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.291
OS: Darwin arm64 25.6.0

For AI issues: add Request ID with privacy disabled

Request ID: 38cef70d-8c7a-4226-bb77-df05daf4f09b

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

5

I treat this as an authorization problem, not a prompting problem: derive a mutation envelope from the request—allowed paths, allowed actions, and whether commits are permitted—and fail closed outside it. A skill may suggest a wider workflow, but widening the envelope should require a new explicit confirmation; its presence on disk must never grant authority.

7

Hey @Jakub_Pelak and @izgorodin,
A few guardrails that fix this today:

  • Approvals: Settings > Agents > Approvals & Execution - use Auto-review or Allowlist (not Run Everything). There, git commit needs your approval by default. On Auto-review you can also add “every git commit or stage should require approval.” Run Modes
  • That commit skill: add disable-model-invocation: true to its frontmatter (or remove it) so it only runs when you type /skill-name, never on its own. Agent Skills
  • Persistent scope: an Always-Apply rule or AGENTS.md line: “Only change the files I ask about. Never stage or commit unless I explicitly ask.” Rules
  • Proposal-first: Ask mode is read-only and Plan stays read-only until you approve the plan (Shift+Tab to switch). Modes

The approval setting plus disabling that skill should stop the unrequested commits. Passing the broader scope feedback along too - if it still overshoots with those in place, send the request ID and I’ll dig in.