Cloud Agent instructions block `gh` writes even when a write-scoped `GH_TOKEN` is provided

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cloud Agent (GitHub, Slack, Web, Linear)

Describe the Bug

Cursor’s recommended fix for cloud agents that can’t write to PRs is to add a personal access token as the GH_TOKEN secret (1, 2). I did that. gh auth status inside the agent shows my token with repo scope, so gh can write.

The agent still refuses to use it, because its built-in instructions say gh is read-only and that PR writes must go through Cursor’s PR tool. This isn’t a token problem: the token works, and the instructions forbid using it.

The PR tool doesn’t cover several common tasks:

  • Updating the description of a PR that a different cloud agent opened.
  • Stacking GitHub PRs. The tool’s stacking support only covers Origin repositories.
  • Adding screenshots to a PR description. The tool uploads images to public cursor.com/artifacts links, readable by anyone with the URL, instead of GitHub attachments that follow repo access. My agent wouldn’t put unreleased UI on a public link, so I had to run the GitHub upload command myself and paste the URLs back to it.

My current workaround is an outside automation that edits PR descriptions and stacks PRs for the agent. That shouldn’t be necessary when the agent already has a token that can do it.

Steps to Reproduce

  1. Create a GitHub personal access token with repo scope and add it under Cloud Agents > Secrets as GH_TOKEN.
  2. Start a cloud agent on a repo and confirm gh auth status lists that token with repo scope.
  3. Ask the agent to edit the description of an existing PR that a different agent opened, or to stack two PRs on GitHub.
  4. The agent refuses to run gh pr edit or gh api, saying gh is read-only in this environment and PR writes must go through the PR tool.
  5. Ask it to add screenshots to a PR. The PR tool turns them into public cursor.com/artifacts links instead of GitHub attachments.

Expected Behavior

If I provide a GH_TOKEN with write scope, the agent’s instructions should let it use gh for writes, or there should be a setting that allows it. At minimum, the instructions shouldn’t forbid what Cursor itself recommends as the fix. The PR tool should also be able to upload images as GitHub attachments that only people with repo access can open.

Operating System

MacOS

Version Information

Version: 3.22.12
VS Code Extension API: 1.128.0
Commit: 3a92974361033b2051526321308c2740fe5912c0
Date: 2026-09-26T04:55:12.125Z
Layout: Agent Window
Build Type: Stable
Release Track: Default
Electron: 42.10.0
Chromium: 148.0.7778.280
Node.js: 24.18.1
V8: 14.8.178.38-electron.0
xterm.js: 6.1.0-beta.291
OS: Darwin arm64 27.0.0

For AI issues: which model did you use?

Claude Opus 5.5 (high)

also observed with GPT-5.6 Sol (high)

For AI issues: add Request ID with privacy disabled

bc-01a0f54f-dd3d-7802-b545-905a3ccc2f81

Does this stop you from using Cursor

No - Cursor works, but with this issue

1 Like