Ask mode is supposed to keep the agent read-only (no shell, no file writes, no system changes) . In a session today, the main agent was in Ask mode but still invoked the Task tool to spawn a shell subagent with a prompt to connect to MySQL and run queries on the local dev database. Ask mode did not block that. The subagent only stopped because I aborted it — not because Ask mode prevented it.
Repro (approximate)
Open Cursor in Ask mode.
Ask the agent to read from a local database and create a file (or any task requiring shell/DB).
Observe whether the agent can call Task → subagent_type: "shell" with a prompt to run mysql or similar.
Expected: blocked with “switch to Agent mode.” Actual: subagent launch was attempted.
Hey, thanks for the detailed report. You’re right to expect this. In Ask mode, the agent should stay read-only, and that restriction should also apply to any subagents spawned via the Task tool. The fact that a shell subagent was able to connect to MySQL and run requests isn’t supposed to happen.
To reproduce this and dig in, could you please share:
Your Cursor version Help > About or Cursor > About Cursor and your OS
The Request ID for that session chat menu in the top right > Copy Request ID. Note that if Privacy Mode is on, the Request ID might not be available
If you can, the model you had selected, and if possible a transcript or screenshot of the moment where the Task tool is called with subagent_type: "shell"
With that info I can reproduce it and file an issue. We’ve seen similar reports already, so you’re not the only one hitting this. Once you’ve gathered the info, reply here.