Clear Violation of Security on Cursor - AI reads API keys from .env

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

My .env file is in the .cursorignore. The env file has a lot of sensitive API keys for external interfacing. I was writing a prompt to the model to perform a particular task. It then recommended me on tab complete entire API key which verbatim matched the API key in the env file, down to every character!! (I wanted to type “along” and the API key is of the format “alohi_pat_<>” and I had typed "alohi). How is the OK? How is the AI agent able to read the contents in the .env file if AI usage on it is disabled?

Steps to Reproduce

  • Put your .env in .cursorignore
  • Add an API key that begins with a detectable textphrase and alphanumeric characters after that (eg: zensei_pat_1234567890ABCDEF)
  • Type that keyword (zensei) in the chat and see if they key appears in tab complete.

Expected Behavior

The AI agent should A) not be able to read the contents in the .env file if it is in .cursorignore and B) should never recommend entire API keys on tab complete.

Screenshots / Screen Recordings

Screenshot 2026-08-26 at 8.43.49 PM copy.png
Screenshot 2026-08-26 at 8.43.49 PM copy.png756×862 89.1 KB

Operating System

MacOS

Version Information

Version: 3.17.19
VS Code Extension API: 1.128.0
Commit: ae3a2b7231dd56194447fe4570dfdc61640b1e90
Date: 2026-08-24T06:42:14.583Z
Layout: IDE
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.291
OS: Darwin arm64 25.5.0

For AI issues: which model did you use?

GPT-5.6 Sol

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey @sansiddh, thanks for the detailed report!

To clarify what’s going on: the completion you saw in the chat box comes from a local autocomplete feature that suggests words from the text visible in your currently open editor tabs. It’s simple text matching that runs entirely on your machine, so the contents of your .env were not read by the model or sent anywhere by that suggestion.

That said, it makes sense that .cursorignore would apply here as well. I’ll flag that for the team!

In the meantime, if it’s important, you can turn the prompt autocomplete off in Cursor Settings under Agents → Agent Autocomplete.