Critical: Mac User Files Disappear After Cursor Keychain Issue

Support Help
,
1

Hi Cursor team,

I’m experiencing a serious issue with Cursor on my MacBook Pro that has now happened twice — July 29 and August 3, 2026.

After the first incident, I completely reset and reinstalled macOS. I then set up the Mac again, installed Cursor, pulled new development projects, created folders, and added new files.

On August 3, the same issue happened again.

What happened

While using Cursor, it requested access related to Keychain/other applications. I denied the access.

Afterward, macOS Keychain Access displayed an error saying that a keychain could not be found to store the information, with options including Cancel and Reset to Default. I selected Reset to Default.

After this, my Mac appeared to have a fresh user environment using the same username. My Desktop, Documents, applications, and other files were no longer displayed.

iCloud/Desktop & Documents syncing was already OFF.

I checked /Users and found only:

/Users/sr

The current /Users/sr directory is only around 3.9 GB, and my previous data is not present there.

Important system logs

I also found the following AppleSystemPolicy messages in the system logs:

2026-08-03 20:45:00.488 Df kernel[0:161d30] (AppleSystemPolicy) ASP: Security policy would not allow process: 42229, /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)

2026-08-03 20:45:00.488 Df kernel[0:161d31] (AppleSystemPolicy) ASP: Security policy would not allow process: 42230, /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)

2026-08-03 20:45:00.489 Df kernel[0:161d32] (AppleSystemPolicy) ASP: Security policy would not allow process: 42231, /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)

2026-08-03 20:45:00.489 Df kernel[0:161d33] (AppleSystemPolicy) ASP: Security policy would not allow process: 42232, /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)

I noticed that Cursor appears to have triggered this type of AppleSystemPolicy message around 28,000 times.

I understand that these messages mean macOS’s security policy was preventing a Cursor Helper (Plugin) process from running. I don’t know whether this is related to the missing files, but the timing is concerning and I would like Cursor’s team to investigate it.

My main concern

I am not claiming that Cursor definitely deleted my files. However, the same overall issue has occurred twice, and both incidents involved Cursor/Keychain-related activity.

What concerns me most is:

How could Cursor or one of its helper/plugin processes interact with the macOS user environment, Keychain, or filesystem in a way that could result in a fresh user environment or make existing files/applications disappear?

If macOS denied the process through AppleSystemPolicy, I would also like to understand whether there is a known Cursor issue involving repeated security-policy failures, Keychain access, permissions, or helper processes.

I would appreciate help investigating:

  1. Is there a known Cursor issue with macOS Keychain or user accounts?
  2. Is there a known issue involving Cursor Helper (Plugin) and AppleSystemPolicy?
  3. Why would the Cursor Helper process trigger thousands of AppleSystemPolicy denials?
  4. Could this behavior be related to Keychain access or filesystem permissions?
  5. What Cursor logs or macOS diagnostics should I provide to help identify the root cause?

This is particularly serious because I have already lost data once and do not want this to happen again.

I can provide additional system logs, Cursor logs, macOS version, Cursor version, and diagnostic information if required.

Thank you.

5

Exact same is happening to me. My Mac has been wiped four times now, and I am not confident opening Cursor anymore.

6

Hey, thanks for the detailed report. I’ll go piece by piece since there are really two separate issues here.

  1. Keychain request and Reset to Default
    The Keychain access request is normal Cursor behavior. The app stores an encryption key called Cursor Safe Storage in your login keychain to securely store the auth token. If you deny it, only saving that token is blocked, nothing else. The dialog saying a keychain could not be found is a macOS Keychain Access message that your default login keychain is missing or corrupted. Important point, Reset to Default only recreates the folder ~/Library/Keychains. It does not touch Desktop, Documents, apps, or other files.

  2. Missing home directory
    I get how rough this is. Data loss always hurts, especially twice. But accuracy matters here. What you describe, a fresh user environment with the same username, /Users/sr instead of your data, is at the macOS level, user record, APFS volume, or FileVault. Cursor does not and cannot recreate a user or delete /Users. The app runs without elevated privileges, and those ASP denials mean the helper processes were blocked from launching at all. The fact that it happened again even after a full macOS reinstall also points to the environment, not a specific app.

What to do for recovery right now:

  • Boot into a different admin account or create a new one and check if the old home folder is visible from there.
  • In Terminal run diskutil apfs list and check if there is a separate or detached volume with your data.
  • Check Time Machine or other backups, if you had any.
  • Contact Apple Support. If the user record or APFS setup got wiped, they can diagnose at the OS level.
  1. ASP denials against Cursor Helper Plugin
    This is a known issue for us with security policy behavior on macOS 26.x and we are tracking it. It creates log spam, but it is not the cause of file loss. Things that help:
  • Update to the latest Cursor version.
  • Do a clean reinstall from the official DMG from cursor.com.
  • Optional, reset extended attributes on the app with sudo xattr -dr com.apple.provenance /Applications/Cursor.app

To move forward, can you share your exact macOS version, your Cursor version, and whether FileVault was enabled. If anything comes up that changes the picture, we’ll dig in further.