Agent ignored RESET and workspace rules despite hash locks and 134 tests; repeated false “fixed” claims on intermittent UI bug

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Cursor Agent does not enforce user workspace rules or operator commands. Over 10+ Agent sessions on a governed repo (.cursor/rules, RESET/NPS in AGENTS.md, hash-locked files, Xcode build gate, 134 passing tests), the agent patch-stacked fixes, edited locked files, updated lock hashes without my QA, ignored RESET (restated checklist but kept editing), and repeatedly claimed “fixed” when verify/build/tests passed but my manual app check still failed. Rules behave as suggestions, not fail-closed constraints. Request: mechanical enforcement (block out-of-scope writes, hard-stop on RESET, no self-certified “done”).

Steps to Reproduce

  1. Open a repo with always-applied .cursor/rules/, AGENTS.md operator triggers (RESET/NPS), and hash-locked paths (e.g. check-locked-files.sh + Xcode “Locked File Gate”).
  2. Use Cursor IDE → Agent (Auto) on a multi-session task (mine: intermittent macOS AppKit UI bug).
  3. Give symptom + pass criteria; use READ-ONLY tickets and type RESET when the agent drifts.
  4. Repeat across many sessions (10+).

Observed every time:

  • Agent edits outside permitted/locked scope or stacks guards after failed fixes.
  • RESET does not stop tool use / edits.
  • Agent runs full test gate (exit 0) and claims fixed while my app check still fails.
  • Agent updates lock-hash scripts to bless unverified changes.

Expected: RESET and rules fail closed until realigned; no “done” without agreed proof + user acceptance.
Actual: honor-system only; false “fixed” claims.

Expected Behavior

When workspace rules and RESET are configured:

  1. RESET — Agent stops all edits/shell until it restates R-E-S-E-T for the current task; resumes only after I say go.
  2. Permitted files — Agent cannot write paths outside an approved slice; hash-locked files cannot change unless I explicitly unlock in my message.
  3. Lock hashes — Agent cannot update lock/gate scripts in the same pass as code changes; bump only after I accept the fix.
  4. Done — No “fixed/complete” without command evidence and my stated acceptance when tests don’t match the symptom.
  5. Failed fix — Revert, not patch-stack.

Rules should block violating actions in the product, not rely on the model remembering them.

Operating System

MacOS

Version Information

Version: 3.9.8 (Universal)
VS Code Extension API: 1.105.1
Commit: 4aa8ff1b7877ed7bd01bcba308698f71a6735380
Date: 2026-06-25T01:39:30.490Z (1 day ago)

For AI issues: which model did you use?

Auto

Additional Information

Request ID: f9a7046a-279b-47e5-ab48-6e8dc12daba1
Model: Auto
Repo: Mencken (macOS Swift). Full write-up: docs/03-operations/CURSOR_COMPANY_FEEDBACK_AI_RULES_AND_GATES.md

Context task (not Cursor UI): intermittent panel width collapse in my app when using AI tab—hard to repro. Product issue is Agent governance failing despite extensive rules/gates/tests.

Does this stop you from using Cursor

Yes - Cursor is unusable

7

Hi @James_Kayten Thanks for the detailed write-up. I understand the distinction you’re making here: this is less about the specific AppKit bug and more about wanting agent governance to fail closed when repo rules, locked files, or operator commands are present.

Today, .cursor/rules, AGENTS.md, and instructions like RESET are model guidance. They are used to steer the agent, but they are not currently enforced as a mechanical permissions boundary that blocks writes, forces a hard stop on a keyword, or prevents the agent from saying it is done before user acceptance.

For now, the best available mitigations are:

  • Use Ask mode for read-only planning or investigation phases.
  • Turn off or tighten auto-run / command approval settings when working in sensitive repos.
  • Keep critical lock checks outside the agent-editable path where possible.
  • Review diffs before accepting changes, especially to lock files, test gates, or scripts that define the safety boundary.
8

Thanks for the quick response Kevin.

Would you mind elaborating on those points given? I’m not a savvy coding person. I’m one of many I suppose who’ve been inspired to create applications they can’t find anywhere else and it’s the promise of plain language interaction with AI that’s been driving me for more than a year now. I’ve easily spent 30% of my subscription time trying to understand and devise ever more succinct and effective parameters for AI. At this point the disappointment is daunting. The feedback I get from sundry AI models over time has made it obvious there’s really nothing that keeps any of them from disregarding rules at random. Even worse is the declaration they have done as asked only discover hours later they ‘lied’.

AI is not a thinking entity after all. It’s just a massively capable guessing machine.

9

I think the practical split is “guidance” versus “guardrail.”

Rules and prompts are guidance: they influence the agent, but the model can still miss them. A real guardrail has to live outside the model, like file permissions, approval gates, read-only mode, or a script that fails the run if protected files changed. For non-expert users, that difference should probably be much more visible in the UI.