It looks like this is an issue when the model chooses to use absolute paths when editing files instead of workspace relative paths. If you ask the model to use relative paths when editing files, things work as expected. I think that’s why disabling the External-File protection works.
Edit: This actually seems related to another bug where edits in the file aren’t working correctly. If the agent edits the file by shell command, the file changes, but then the changes seem to revert if you reload Cursor to see them.