Agent hallucinated unrelated trading bot project (created files outside requested scope)

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

I was using Cursor Agent Mode (Auto) on a clean Flutter project.

I provided a long prompt requesting the design and implementation of an agnostic tween engine. Prompt discussed:

  • Dart / Flutter
  • GraphX architecture
  • Tween engines
  • Animation systems
  • Timelines
  • Frame invalidation
  • Performance considerations
  • Creating files under a specific folder: lib/motion_cursor

The request had absolutely no relation to finance, trading, Python trading bots, Alpaca, or stock market software.

Instead of working on the requested tween engine, the agent generated a complete stock trading bot proposal, including files such as:

  • run_dip_bot.py
  • broker.py
  • config.py
  • dip_scanner.py
  • risk.py
  • update_positions.py

The output also referenced:

c:\Users\Administrator\Desktop\trading bot

which is unrelated to my project and environment, very scary

More concerning, the agent created these files inside my project directory even though they were unrelated to the task.

This appears to be a severe hallucination or context-routing failure because the generated result has no semantic relationship to the prompt that was provided.

Steps to Reproduce

  1. Open Cursor Agent Mode.
  2. Use Auto mode.
  3. Created a clean Flutter project.
  4. Provide a prompt requesting architecture and implementation work for some animation engine.
  5. Mention creating files in a specific project subfolder.
  6. Allow the agent to execute autonomously.
    In my case, instead of working on the tween engine, the agent generated and created files for a completely unrelated stock trading bot.

I have attached screenshots of:

  • The original prompt with the generated trading bot response.
  • The files that were created.

Expected Behavior

  • Worked on the requested tween engine architecture.
  • Created files only within the requested folder.
  • Generated Dart code relevant to the Flutter project.
  • Asked for clarification if the request was ambiguous.

The agent should not generate an unrelated project from a completely different domain, nor create unrelated files inside the workspace, with a predefined Windows sys path, when i’m on MacOS

Screenshots / Screen Recordings

gen files.png
gen files.png988×1228 76.3 KB
prompt.png
prompt.png1668×1780 93.3 KB

Operating System

MacOS

Version Information

Version: 3.10.19
VS Code Extension API: 1.125.0
Commit: 8fd6d68fb73686cd1a6aef45d3b789e057ae0460
Date: 2026-07-06T19:51:11.323Z
Layout: Agent Window
Build Type: Stable
Release Track: Nightly
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.256
OS: Darwin arm64 25.5.0

For AI issues: which model did you use?

Auto

For AI issues: add Request ID with privacy disabled

f9a7046a-279b-47e5-ab48-6e8dc12daba1

Additional Information

Agent was running in Auto mode.

The workspace was a Flutter project and the prompt was specifically about designing a tween engine architecture for a package of mine/

The generated output referenced a Windows path:

c:\Users\Administrator\Desktop\trading bot

even though Cursor was running on macOS.

The agent then created multiple unrelated Python files inside the project workspace. Very scary

The generated files appeared unrelated to the prompt and were not requested.

Because this workspace was not under git version control, the generated files had to be manually removed.

I have attached screenshots of:

  • original prompt + generated response
  • The files created in the workspace

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey, thanks for the detailed report and the screenshots. I get why it looks scary, but I want to clear up the main concern right away: this is not a data leak from another session. Sessions are isolated, and the fake Windows path c:\Users\Administrator\Desktop\trading bot showing up on your macOS is the key sign that the content was made up by the model, not pulled from someone else’s environment.

You can see this clearly in the first screenshot: the files were created with the literal Windows path inside the filename (c:\Users\Administrator\Desktop\trading bot\broker.py, etc.). A real leak wouldn’t turn a Windows path into a filename on macOS. The model just invented a self consistent project and path, and the file tool saved that string as the filename. So this is a model hallucination, not someone else’s data.

This is a bug on our side and we’re tracking it, but I can’t share an ETA for a fix yet.

Workarounds that help:

  • Pick a specific frontier model in the chat (like Sonnet, GPT, or Opus) instead of Auto. These hallucinations are much rarer there.
  • Start a new chat and keep the context small.
  • Keep your project in git so you can roll back any unwanted files with one command instead of deleting them by hand.

If you hit this again on a specifically selected frontier model (not Auto), let me know. That would be more useful to investigate.

Also, the Request ID f9a7046a-... didn’t link to this session, so it looks like the wrong one was copied. Next time it’s easiest to grab the ID from the chat menu: three dots in the top right > Copy Request ID. Then we don’t need to search for anything else.

7

Thanks for the reply @deanrie,

The scary thing isn’t the generated files perse, but the level of hallucination and the tool calling capabilities it made me feel like I’ve been hacked.

Plus by the time I was signing up here for the bug report, the first message I see in a thread is deletion of files on disks, several users reporting similar experiences.

I just don’t feel comfortable using Cursor after this experience.

8

I get it, that feeling really sucks. When you see a project that doesn’t look like yours and a Windows path, the first thought is usually “I’ve been hacked”. But let me split this into two parts so it’s less stressful.

About the hallucination. This isn’t a hack and it isn’t someone else’s data. The fact it shows a fake path like c:\Users\Administrator\Desktop\trading bot on your macOS is actually proof the model made it up, not pulled it from another environment. A real leak wouldn’t turn a Windows path into a filename on a Mac. Sessions are isolated. This happens more often on Auto, since it can route you to Composer 2.5 or 2.5 Fast. So the advice to pick a specific frontier model Sonnet, GPT, or Opus still stands, it’s much rarer there.

About the file deletion you saw in another thread. That’s a separate case and not related to yours. It usually happens when an agent is allowed to auto-run shell commands and it runs something destructive. The main protection for both cases is the same:

  • Keep your project in git and commit regularly, then any unwanted files or changes are one command to revert.
  • Don’t enable auto-run for everything. Review the agent commands before approving, especially destructive ones.
  • Start a new chat for a new task and keep the context small.

This is a bug on our side and it’s being tracked. If you hit it again on a specifically selected frontier model, not Auto, please post here with the Request ID right corner of the chat > Copy Request ID. That would really help with the investigation. Let me know if you still have questions.

9

Hey, big fan of your Flutter work by the way. Saw your post about Agent Mode generating a whole trading bot out of nowhere instead of the tween engine you asked for, that is a wild kind of hallucination.

Curious about one thing: do you usually run agents like this on your own personal projects, or does this ever happen on client work too? And did that incident change how closely you review what the agent touches before committing?

10

On personal projects and prototypes, usually I vibe code like that, yes. Haven’t use Cursor on work directly, but on production work I had to be much more atomic on prompts.

It goes beyond reviewing the output though, I haven’t use AI for coding since this hallucination experience

11

@roipeker Wow, quitting AI coding entirely after that is a pretty strong reaction. Curious, is that permanent, or is it more that you just have not found something reliable enough to trust again? If there was a way to guarantee the agent could only touch the exact files you approved, would that change anything for you?

12

No mate, it’s not about quitting AI-assisted coding entirely, I doubt that is a realistic option anymore.

The experience described in this post did push me to reconsider how I use it though. After more than, idk ~25 years of coding?, I realized I missed thinking through problems deeply, reasoning step by step, do a stackoverflow research :upside_down_face: , and writing more of the code myself.

AI can produce impressive results in no time, can help paying the bills; but for me it also introduced anxiety, weakened my focus, and totally reduced the sense of accomplishment I used to get from my work (and projects like graphx). That is a personal issue, separate from the incident discussed here, but it made me want to become more intentional and aware of what I am doing again.

So yep, stronger guarantees around file access totally helps with trust, but that would not fully address the broader concerns I have about how AI affects my development process, as I’m sure it happens to so many other software engineers (or old school devs). So i’m still trying to find the proper balance, but I need to go back to “manual” mode first, for a while.

13

Thanks for laying this out so honestly. This goes way beyond a bug.

Wanting to go back to thinking through the task yourself and writing code by hand makes total sense. That sense of accomplishment is real, and the tool should fit into your workflow, not break it. Take a break for as long as you need.

Thanks for everything you do for the Flutter community, including graphx. When you’re ready to come back, we’ll be here.

14

That makes sense. The “I stopped using AI for coding after this” part is exactly the trust problem I was wondering about.

I’m building a small local tool called ScopeLock for this: approve exact scope first, run the agent in isolation, reject out-of-scope changes, run checks, and keep a receipt.

Curious, would that kind of bounded flow make you comfortable trying AI coding again, or would you still avoid it after this?

16

I’m not avoiding it, this particular case set a red flag for me to stop for a sec to process more the implications, at personal level, as a developer, and the security breach anyone who tries to stay up to date with how ai and tooling are evolving, is very tempting to give full control over everything eventually. Who wouldn’t wanna try Codex or anthropic when it can work in isolation on ur OS, run virtualized system events that allows full automation over a tasks? The selling point is magical at that stage. Beyond VM virtualization to have a constrained environment, idk how an autonomous ai system can be blocked from malicious acts or terrible allucinantions that leads to catastrophes for the user. Eventually most of us tends to give that elevated permission at some point I guess

17

@roipeker Yeah, that’s the scary part: the magic and the risk come from the same place and giving agents more autonomy. I’m experimenting with a small local tool called ScopeLock around this idea: run the agent isolated, approve the exact repo scope, reject out-of-scope changes before they reach the real project, and keep an audit trail.

Not a full OS sandbox, and not a replacement for thinking. But maybe a better default than “agent can touch whatever the process can”.

Curious if that kind of boundary would reduce the anxiety, or if the bigger issue is more about keeping the deep-thinking/manual part of coding?