Cursor Agent auto-ran a command that wiped an entire drive (Windows / PowerShell)

Support Bug Reports
, , , ,
6

Hey @Newts00579 I’m really sorry. Losing almost an entire drive, especially with TRIM, is a really rough scenario. Thanks for such a detailed breakdown and for the safe repro with echo, it’s genuinely helpful.

This is an issue we’re tracking. I’ve passed your report, the Request ID, and all five suggestions to the team: confirmation for recursive or forced delete, a sandbox on Windows, blocking drive roots and paths outside the workspace, killing the full process tree on timeout, and stopping on abnormal environment changes. I also separately passed along two more points: the agent reported success after timing out and kept working even though the paths were gone, and the near-miss with E: in the safe-delete helper. There’s no timeline yet, but I’ll post here when there’s an update.

To make it easier for the team to investigate, could you please answer two questions:

  1. What Run Mode was set in Cursor Settings > Agents > Approvals & Execution at the time of the incident: Auto-review, Allowlist, or Run Everything?
  2. Did your allowlist include cmd, powershell, or other general wrappers?

Until there’s stronger protection on Windows, I’d recommend this:

  • Switch Run Mode to Allowlist and keep the list short, with only specific safe commands like npm test. No cmd, powershell, or pwsh. Anything not on the list will wait for your approval. Also note that the allowlist is best-effort, not a security boundary: Run Modes | Cursor Docs
  • Add a user-level beforeShellExecution hook in ~/.cursor/hooks.json. The hook should check the command text and return exit code 2 to block if it sees rmdir /s, rd /s, del /s, Remove-Item -Recurse, or format. That gives you a deterministic stop no matter how the model phrases the command: Hooks | Cursor Docs
  • Before you approve, read any delete command in full, especially ones using cmd /c and nested quotes
  • Keep backups of important data on a separate drive or in the cloud, and make sure the agent can’t access them

For recovery, if some projects were in a git remote or cloud sync, you may be able to restore them from there. It sounds like you’ve already recovered about as much as possible otherwise.

Let me know the Run Mode when you get a minute.