Hey, that’s a fair point. “Hallucination” isn’t really the most accurate term here. You’re right that the real issue is more about how the model prioritizes different instruction sources. User rules are added to the context not as direct user input, but as extra content, and the model can treat them as less trusted, especially for actions like git that it sees as potentially destructive.
Basically, this is a prompt architecture problem. We need the model to clearly understand that rules equal explicit user intent. The team is aware of this, and there are quite a few similar reports on the forum, including this one: Cursor System Prompt conflicts with user System Prompt. It raises the same priority conflict issue. I can’t say when it’ll be fixed yet, but your report helps us prioritize it.
I get that rewriting rules is a workaround, not a real fix. But for now, more specific wording with exact commands works noticeably more reliably. Not because it’s the right way, but because it’s easier for the model to stick to the instruction.