Where does the bug appear (feature/product)?
Cursor IDE
Describe the Bug
During a long Agent chat session (Remote SSH: Windows client → Linux remote workspace), the IDE repeatedly failed turns with:
[internal] …:error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT:
....\third_party\boringssl\src\crypto\fipsmodule\cipher\e_aes.cc.inc:839:
We observed multiple BAD_DECRYPT errors in the same conversation (on the order of 7 occurrences across the main chat and subagents).
After one successful assistant reply (“nothing to commit”), the agent started a new turn without any user message: it ran grep for rrweb / session recording, read package.json, and produced a long generic answer about Sentry Session Replay and npm install @sentry/react — topics the user never asked about in that thread.
There was no corresponding user message in the exported agent transcript for that turn. This looks like session/context integrity failure (decrypt/recovery or turn boundary bug), not application code in our repo.
Impact: loss of trust in agent output after decrypt errors; risk of following phantom advice (e.g. installing packages). No evidence of unauthorized git push or shell execution from that phantom turn in our case — only grep/read in transcript.
Steps to Reproduce
Hard to reproduce deterministically. Pattern we saw:
Long-running Agent session with many tool calls (git, tests, browser preview browser_element messages, subagents).
Intermittent BAD_DECRYPT on turn_ended (status error).
Occasionally duplicate or empty assistant turns.
At least once: assistant full response on a topic user did not request, with no user message before it.
Expected Behavior
Each assistant turn follows an explicit user message (or an approved automation trigger).
No BAD_DECRYPT during normal chat/agent operation.
After a crypto/decrypt failure, UI should not show fabricated user intent or continue unsafe tool flows without clear recovery.
Actual Behavior
Repeated BAD_DECRYPT in one session.
Phantom assistant turn (Sentry/rrweb session recording guide) without user query.
Possible desync between UI transcript and actual turn sequence.
Environment
Setup: Cursor Agent, Remote SSH (client OS: Windows; remote: Linux)
Operating System
Windows 10/11
Version Information
Cursor version: 3.7.36 (system setup)
VS Code Extension API: 1.105.1
Commit: 776d1f9d76df50a4e0aeca61819a88e7c1b861e0
Date: 2026-06-13T00:31:56.287Z
Layout: glass
Build Type: Stable
Release Track: Default
Electron: 39.8.1
Chromium: 142.0.7444.265
Node.js: 22.22.1
V8: 14.2.231.22-electron.0
xterm.js: 6.1.0-beta.256
OS: Windows_NT x64 10.0.19045
Local agent transcript export id (for our records only): 44b07045-ad5a-490e-80ce-714661a25a83
For AI issues: which model did you use?
sonet 4.6
Additional Information
Local agent transcript export id (for our records only): 44b07045-ad5a-490e-80ce-714661a25a83
We can provide redacted transcript excerpts on request (no cookies, no API keys).
Internal runbook: session treated as untrusted after BAD_DECRYPT; new chat for sensitive work.
Does this stop you from using Cursor
No - Cursor works, but with this issue