Agent hallucinated unrelated trading bot project (created files outside requested scope)

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

I was using Cursor Agent Mode (Auto) on a clean Flutter project.

I provided a long prompt requesting the design and implementation of an agnostic tween engine. Prompt discussed:

  • Dart / Flutter
  • GraphX architecture
  • Tween engines
  • Animation systems
  • Timelines
  • Frame invalidation
  • Performance considerations
  • Creating files under a specific folder: lib/motion_cursor

The request had absolutely no relation to finance, trading, Python trading bots, Alpaca, or stock market software.

Instead of working on the requested tween engine, the agent generated a complete stock trading bot proposal, including files such as:

  • run_dip_bot.py
  • broker.py
  • config.py
  • dip_scanner.py
  • risk.py
  • update_positions.py

The output also referenced:

c:\Users\Administrator\Desktop\trading bot

which is unrelated to my project and environment, very scary

More concerning, the agent created these files inside my project directory even though they were unrelated to the task.

This appears to be a severe hallucination or context-routing failure because the generated result has no semantic relationship to the prompt that was provided.

Steps to Reproduce

  1. Open Cursor Agent Mode.
  2. Use Auto mode.
  3. Created a clean Flutter project.
  4. Provide a prompt requesting architecture and implementation work for some animation engine.
  5. Mention creating files in a specific project subfolder.
  6. Allow the agent to execute autonomously.
    In my case, instead of working on the tween engine, the agent generated and created files for a completely unrelated stock trading bot.

I have attached screenshots of:

  • The original prompt with the generated trading bot response.
  • The files that were created.

Expected Behavior

  • Worked on the requested tween engine architecture.
  • Created files only within the requested folder.
  • Generated Dart code relevant to the Flutter project.
  • Asked for clarification if the request was ambiguous.

The agent should not generate an unrelated project from a completely different domain, nor create unrelated files inside the workspace, with a predefined Windows sys path, when i’m on MacOS

Screenshots / Screen Recordings

gen files.png
gen files.png988×1228 76.3 KB
prompt.png
prompt.png1668×1780 93.3 KB

Operating System

MacOS

Version Information

Version: 3.10.19
VS Code Extension API: 1.125.0
Commit: 8fd6d68fb73686cd1a6aef45d3b789e057ae0460
Date: 2026-07-06T19:51:11.323Z
Layout: Agent Window
Build Type: Stable
Release Track: Nightly
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.256
OS: Darwin arm64 25.5.0

For AI issues: which model did you use?

Auto

For AI issues: add Request ID with privacy disabled

f9a7046a-279b-47e5-ab48-6e8dc12daba1

Additional Information

Agent was running in Auto mode.

The workspace was a Flutter project and the prompt was specifically about designing a tween engine architecture for a package of mine/

The generated output referenced a Windows path:

c:\Users\Administrator\Desktop\trading bot

even though Cursor was running on macOS.

The agent then created multiple unrelated Python files inside the project workspace. Very scary

The generated files appeared unrelated to the prompt and were not requested.

Because this workspace was not under git version control, the generated files had to be manually removed.

I have attached screenshots of:

  • original prompt + generated response
  • The files created in the workspace

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey, thanks for the detailed report and the screenshots. I get why it looks scary, but I want to clear up the main concern right away: this is not a data leak from another session. Sessions are isolated, and the fake Windows path c:\Users\Administrator\Desktop\trading bot showing up on your macOS is the key sign that the content was made up by the model, not pulled from someone else’s environment.

You can see this clearly in the first screenshot: the files were created with the literal Windows path inside the filename (c:\Users\Administrator\Desktop\trading bot\broker.py, etc.). A real leak wouldn’t turn a Windows path into a filename on macOS. The model just invented a self consistent project and path, and the file tool saved that string as the filename. So this is a model hallucination, not someone else’s data.

This is a bug on our side and we’re tracking it, but I can’t share an ETA for a fix yet.

Workarounds that help:

  • Pick a specific frontier model in the chat (like Sonnet, GPT, or Opus) instead of Auto. These hallucinations are much rarer there.
  • Start a new chat and keep the context small.
  • Keep your project in git so you can roll back any unwanted files with one command instead of deleting them by hand.

If you hit this again on a specifically selected frontier model (not Auto), let me know. That would be more useful to investigate.

Also, the Request ID f9a7046a-... didn’t link to this session, so it looks like the wrong one was copied. Next time it’s easiest to grab the ID from the chat menu: three dots in the top right > Copy Request ID. Then we don’t need to search for anything else.

7

Thanks for the reply @deanrie,

The scary thing isn’t the generated files perse, but the level of hallucination and the tool calling capabilities it made me feel like I’ve been hacked.

Plus by the time I was signing up here for the bug report, the first message I see in a thread is deletion of files on disks, several users reporting similar experiences.

I just don’t feel comfortable using Cursor after this experience.

8

I get it, that feeling really sucks. When you see a project that doesn’t look like yours and a Windows path, the first thought is usually “I’ve been hacked”. But let me split this into two parts so it’s less stressful.

About the hallucination. This isn’t a hack and it isn’t someone else’s data. The fact it shows a fake path like c:\Users\Administrator\Desktop\trading bot on your macOS is actually proof the model made it up, not pulled it from another environment. A real leak wouldn’t turn a Windows path into a filename on a Mac. Sessions are isolated. This happens more often on Auto, since it can route you to Composer 2.5 or 2.5 Fast. So the advice to pick a specific frontier model Sonnet, GPT, or Opus still stands, it’s much rarer there.

About the file deletion you saw in another thread. That’s a separate case and not related to yours. It usually happens when an agent is allowed to auto-run shell commands and it runs something destructive. The main protection for both cases is the same:

  • Keep your project in git and commit regularly, then any unwanted files or changes are one command to revert.
  • Don’t enable auto-run for everything. Review the agent commands before approving, especially destructive ones.
  • Start a new chat for a new task and keep the context small.

This is a bug on our side and it’s being tracked. If you hit it again on a specifically selected frontier model, not Auto, please post here with the Request ID right corner of the chat > Copy Request ID. That would really help with the investigation. Let me know if you still have questions.