Hey, this is known behavior. In Auto-Run in Sandbox mode, which is the default, the Command Allowlist is not applied. The sandbox replaces it with filesystem and network restrictions instead of per-command approval. The UI is confusing because the allowlist field still looks like it’s active.
So rm running without confirmation isn’t model-specific. It’ll happen with any model in sandbox mode.
Workaround: enable Legacy Terminal Tool in Cursor Settings > Agents > Inline Editing & Terminal. After that, the allowlist will be enforced and rm will require your approval.
More context here: Command Allowlist is silently ignored when "Auto-Run in Sandbox" is enabled
Let me know if that helps.