Agent modifies git internal files outside workspace, corrupting worktree references

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

When working in a project that uses git worktrees, the Cursor Agent modified files outside the open workspace directory — specifically, it overwrote .git/worktrees/*/gitdir, redirecting internal git references to an unintended path. This caused the git repository structure to break silently.

Steps to Reproduce

Open a git worktree (e.g., Z:\dev\git\MyProject) as the workspace in Cursor.
Ask the Agent to edit project source files.
The Agent autonomously creates and operates within C:\Users<user>.cursor\worktrees\ (a Cursor-managed worktree copy).
The Agent modifies Z:\dev\git\MyProject.git\worktrees\nkn\gitdir to point to the C:\Users... path instead of the original.
Expected Behavior

Expected Behavior

The Agent should never modify files outside ${workspaceFolder} without explicit user permission.
Git internal metadata files (.git/ and its subdirectories) should be treated as read-only by the Agent under all circumstances.
File operations should be strictly sandboxed to the workspace root.
Actual Behavior

The Agent silently rewrote .git/worktrees/nkn/gitdir, corrupting the git worktree linkage.
Source code edits were applied to the Cursor-managed worktree (C:\Users....cursor\worktrees) rather than the actual project directory, causing confusion about which files were being compiled and run.
The user had to manually restore the git metadata and delete the unintended worktree directory.
Impact

Data integrity: Git internal references were corrupted without warning.
Security: The Agent demonstrated the ability to write to arbitrary filesystem paths outside the workspace, including system-level user directories.
User trust: Changes appeared to succeed but were applied to the wrong location, leading to significant debugging time.

Operating System

Windows 10/11

Version Information

Version: 2.6.20 (user setup)
VSCode Version: 1.105.1
Commit: b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad760
Date: 2026-03-17T01:50:02.404Z
Build Type: Stable
Release Track: Early Access
Electron: 39.8.1
Chromium: 142.0.7444.265
Node.js: 22.22.1
V8: 14.2.231.22-electron.0
OS: Windows_NT x64 10.0.26100

For AI issues: which model did you use?

Composer 1.5 and Opus 4.6 Max

Does this stop you from using Cursor

No - Cursor works, but with this issue

4

Hey, thanks for the detailed report. This is a known issue type. The agent can quietly switch to worktree mode and start writing to ~/.cursor/worktrees/ instead of your real project folder.

The extra issue you hit .git/worktrees/*/gitdir corruption happens because your workspace is already a git worktree. When Cursor creates its own managed worktree using git worktree add, Git updates internal references in the parent repo as a side effect. The sandbox currently doesn’t protect .git/worktrees/*/gitdir files.

Workaround for now:

  • Before you start an agent session, check the environment dropdown at the bottom of the chat panel. Make sure it says Local, not Worktree.
  • If the session already started with worktree enabled, start a new chat and pick Local explicitly.
  • You can also watch for the branch icon to the right of the model picker. If you see it, worktree mode is on.

Similar reports for reference:

The team is aware of this. Your report adds a helpful data point, especially the worktree inside a worktree case and the gitdir corruption detail. There’s no timeline for a fix yet, but this helps with prioritization.

Let me know if you have questions.