Agent executes destructive git commands without confirmation

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Previously, Cursor had a setting in Settings → Agents that required manual confirmation before the agent executed destructive git commands: commit, reset, restore, checkout. Every time the agent attempted to run one of these commands, a dialog appeared in the UI asking me to click Allow or Reject.
After the latest Cursor update (2.5), this setting is gone. Now the agent executes git reset and git checkout without any confirmation, even though these commands are not in my Command Allowlist.
These commands are not in my Command Allowlist, but the agent runs them anyway without prompting.
Expected: agent shows Allow/Reject dialog before executing destructive git commands.
Actual: agent executes them silently without confirmation.

Steps to Reproduce

  1. Open Cursor with Auto-Run Mode set to “Auto-Run in Sandbox”
  2. Make sure git reset, git checkout, git commit are NOT in the Command Allowlist
  3. Ask the agent to perform any task that involves git changes
  4. Observe: agent executes git reset or git checkout without showing Allow/Reject dialog

Operating System

MacOS

Version Information

Version: 2.5.17
VSCode Version: 1.105.1
Commit: 7b98dcb824ea96c9c62362a5e80dbf0d1aae4770
Date: 2026-02-17T05:58:33.110Z

Does this stop you from using Cursor

No - Cursor works, but with this issue

3

Hey, this is a known issue. In Auto-Run in Sandbox mode, the Command Allowlist isn’t applied. Sandbox replaces per-command approvals with filesystem and network restrictions, but the UI doesn’t explain this well.

The same issue is described here: Command Allowlist is silently ignored when “Auto-Run in Sandbox” is enabled

Workaround: enable Legacy Terminal Tool in Cursor Settings > Agents > Inline Editing & Terminal. With that, the allowlist works as expected, and git commands will require approval again.

The team is aware the UI is misleading. It shows the allowlist as active even though it’s not used in sandbox mode.

Let me know if the workaround doesn’t help.

4

But in Cursor, besides Allowlist, there was another setting to prohibit automatic repository changes (checkout, commit, reset, etc.).
In the latest version, this setting has been removed. Why?