I asked the agent to do a task, it started to look at code which was outside of my opened project.
I have a reference/ folder which is gitignored, but is marked as excluded in my cursorignore file. It seems like main agents can read this reference folder but the folder appeared empty to the sub agent. It then decided to search elsewhere on my computer for the code?
Steps to Reproduce
Uncertain
Expected Behavior
Cursor shouldn’t be able to read or write files that our outside of the directory that I have open. It shouldn’t be able to escape the directory by using ../
Hi @zanawar, Thanks for raising this. I checked the run, and the parent agent explicitly instructed the subagent to search F:\sbox\shoothouse and F:\sbox\ruit\RefUI. It did not independently escape the open project using ../; it followed those absolute paths.
The open workspace is the default working directory, but it is not currently a hard boundary for reads. Your .cursorignore file under F:\sbox\gamejam3 applies within that directory tree and does not automatically cover sibling folders.
To exclude sibling projects, add appropriate .cursorignore rules in those project roots or use global ignore patterns. Keep in mind that terminal and MCP tools are governed separately and should not be treated as fully restricted by .cursorignore. Outside-workspace writes are handled separately through approval and External-File Protection settings. I did not see an outside-workspace write in this run.
Is there a way to prevent it from reading anything outside of the workspace without manually listing an absolute file path (or what might be dozens of them)? I am unsure how it even learned of those file paths since they’re never referenced inside of my project.
It would be really great to have a global setting like “External-Read Protection”. To create a .cursorignore or sandbox/permission settings per Project/Workspace is inconvenient at best. At worst, information from sibling projects which have nothing to do with the problem at hand lead to wrong conclusions.