Agent prompt injects legacy `<user_rules>` block even when User Rules are empty — duplicates `~/.cursor/rules/*.mdc` content (~2K tokens/waste per turn)

Support Bug Reports
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Summary

Cursor injects rules into agent system prompts through at least two separate channels that are not kept in sync. After migrating User Rules from cloud Settings into ~/.cursor/rules/*.mdc files and clearing Settings, the editor UI, cursor.sh, and cursor_dialog API all report zero user rules — but agents still receive a legacy <user_rules> block on every turn. Six of the seven injected rules duplicate content already loaded from .mdc files via always_applied_workspace_rules.
This wastes roughly ~2K tokens per turn on duplicate content the user did not configure and cannot edit or disable through any visible UI.

Steps to Reproduce

  1. Have User Rules in Cursor Settings (cloud plain-text rules) with titles like committing-changes-with-git, creating-pull-requests, etc.
  2. Migrate that content into ~/.cursor/rules/*.mdc files (with frontmatter, e.g. git-commits.mdc, pull-requests.mdc).
  3. Clear User Rules from Cursor Settings. Verify:
    • Editor Settings → Rules → User Rules: empty
    • cursor.sh account settings: no rules
    • cursor_dialog MCP (item=rule, scope=user, action=list): { "rules": [], "total": 0 }
  4. Confirm ~/.cursor/rules/*.mdc files exist and load (Agent view settings shows them; agents receive always_applied_workspace_rules in prompt).
  5. Start a new agent chat.
  6. Ask the agent: “What user rules are active in this chat?”

Expected Behavior

  • Only one rule source should inject into the agent prompt.
  • If Settings/API/Agent-view file rules are the single source of truth, either:
    • inject from ~/.cursor/rules/*.mdc only, or
    • inject from Settings User Rules only — not both.
  • With zero Settings User Rules and file-backed rules configured, no legacy <user_rules> block with old tag names should appear.

Operating System

Linux

Version Information

  • OS: Linux (Ubuntu, kernel 6.8.0)
  • Cursor agent version: 2026.07.08-0c04a8a
  • Shell: fish

Additional Information

Actual behavior

Agents report two rule buckets in the system prompt:

Bucket 1: always_applied_workspace_rules

Loaded from ~/.cursor/rules/*.mdc (expected). Example paths:

~/.cursor/rules/git-commits.mdc
~/.cursor/rules/communication.mdc
...

Bucket 2: <user_rules> (unexpected ghost injection)

Seven items with legacy cloud tag names, not matching .mdc filenames:

Legacy <user_rules> tag .mdc filename (duplicate content)
committing-changes-with-git git-commits.mdc
creating-pull-requests pull-requests.mdc
(follow-instructions) follow-instructions.mdc
(code-principles) code-principles.mdc
(real-environment) real-environment.mdc
(communication) communication.mdc
(conversation context) —
Bucket 2 persists in new chats after Settings/API show zero rules. The user cannot see, edit, or delete these rules from Editor Settings or cursor.sh.

Additional UI inconsistency discovered

Three surfaces disagree on what “User Rules” means:

Surface Shows
Editor Settings → Rules Empty
cursor.sh No rules
Agent view settings File-backed rules at ~/.cursor/rules/*.mdc
Deleting rules from Agent view settings deletes the .mdc files on disk — Agent view is wired to the filesystem, not the legacy cloud store. But the legacy <user_rules> injection continues regardless.

Impact

  • Token waste: ~8KB (~2K tokens) of duplicate rule content per agent turn, on top of ~20KB of .mdc rules when alwaysApply: true.
  • Confusion: Users cannot reconcile what agents “have” vs what Settings show.
  • Destructive UX: Clearing rules via Agent view deletes real files; legacy injection is unaffected.

Suggested fix

  1. Single source of truth: ~/.cursor/rules/*.mdc OR Settings User Rules — inject one, not both.
  2. Stop injecting legacy cloud User Rules when Settings/API return empty.
  3. Unify UI: Editor Settings, cursor.sh, and Agent view should show the same rule store.
  4. Document that Agent view edits map directly to ~/.cursor/rules/ files.

Workaround (partial)

  • Set alwaysApply: false on situational .mdc rules to reduce always-on token cost (user-controlled portion only).
  • No workaround for legacy <user_rules> ghost injection.

This is particurly annoying for users that might not being using common tooling. Eg. I don’t need rules for interacting with the gh cli tool if I use on-prem gitlab, but cursor injects it regardless.

Does this stop you from using Cursor

No - Cursor works, but with this issue

6

Hi @Nate_Fabian Thank you for the post.

Nothing is broken here, and this isn’t leftover cloud rules or a ghost sync.

Those seven items are Composer’s built-in session instructions (they apply to the Composer model family). They’re part of the model’s prompt, not files or account settings, so they won’t appear in Editor Settings, on cursor.sh, or in ~/.cursor/rules/, and they can’t be edited or removed there. That’s why every editable surface shows zero, but you still see the block. Easy way to confirm: switch the chat to a non-Composer model (Opus, Sonnet, or GPT) and this set disappears, since those models carry their own built-ins.

The overlap with your .mdc files is content, not source. Your filenames line up closely with these built-in categories, so it looks like the guidance maybe got copied into your own files at some point. The two are independent, and Composer already carries this guidance, so you can safely delete those .mdc duplicates.

The built in content does contribute to token usage but it’s a smaller amount typically than the bucket that contains tools, user rules, etc.

Same finding confirmed here: Composer 2.5 always on injected rules and Ghost User Rules still injected in Agent context.