Hey, this is a known issue. In Auto-Run in Sandbox mode, the Command Allowlist isn’t actually applied. The sandbox overrides it by controlling file system and network access instead of approving individual commands. The UI is misleading because it still shows the allowlist as active.
Workaround: enable Legacy Terminal Tool in Cursor Settings > Agents > Inline Editing & Terminal. With that, the allowlist should work as expected, and git commands will require confirmation.
More details in this thread: Command Allowlist is silently ignored when “Auto-Run in Sandbox” is enabled
The team is aware of the UX issue. Let me know if the workaround helps.