Agent sandbox sets system proxy to 127.0.0.1:57126 and breaks all other apps

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Bug:
When Cursor Agent runs (especially shell/network tools), Windows user proxy is set to:
ProxyEnable = 1
ProxyServer = http://127.0.0.1:57126 (port varies)

Effect:

  • Browser, Claude, ChatGPT, and other apps lose internet

  • Cursor itself stays connected

  • Clearing the proxy is temporary; next agent tool use re-enables it

  • Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings

  • Listener on that port is node.exe (Cursor agent network helper / sandbox)

  • WinHTTP shows Direct access; only the per-user Internet Settings proxy is hijacked

Steps to Reproduce

Workaround:
Scheduled task that clears ProxyEnable when ProxyServer is 127.0.0.1/localhost

Expected Behavior

Agent sandbox proxy should not modify system-wide Windows proxy settings, or must clean up and not break other apps.

Operating System

Windows 10/11

Version Information

Version: 3.14.7 (user setup)
VS Code Extension API: 1.128.0
Commit: a758f2241ca99fecf380180b6cbdbbce0f1f42c0
Date: 2026-07-30T06:41:34.009Z
Layout: Agent Window
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.291
OS: Windows_NT x64 10.0.26200

For AI issues: which model did you use?

Grok 4.5 Medium

Does this stop you from using Cursor

No - Cursor works, but with this issue

Hey, thanks for the detailed report. Let’s dig into what’s going on here.

The local listener on 127.0.0.1:<port> you’re seeing is the agent’s per-command network filter sandbox. It’s expected, and by default it only affects the command processes the agent launches. Cursor itself does not change the system Windows proxy settings in the registry HKCU\...\Internet Settings.

If that proxy is getting written system-wide and breaking other apps, on Windows it usually means the agent ran a command during an auto-run session that changed the registry or system proxy. On Windows the sandbox doesn’t isolate the registry, and in auto-run mode commands run without confirmation.

Can you check the agent transcripts for those sessions and look for commands like Set-ItemProperty ... Internet Settings, reg add ... Internet Settings, or netsh? That would confirm the mechanism. If you find anything, paste it here, it’d be super helpful.

What you can do right now:

  • Review your auto-run settings. Switch to requiring confirmation for system-touching commands, or add reg, Set-ItemProperty, netsh to the command denylist.
  • Add a project rule that explicitly forbids the agent from changing system proxy settings.
  • Your scheduled task that resets ProxyEnable when it’s 127.0.0.1 or localhost is a fine stopgap. You can keep it for now.

On its own, the system proxy staying broken for other apps shouldn’t happen. I’ve passed this to the team so they can look at it on the sandbox side. I’ll post here if there’s an update.