Cursor auto-executes a checklist command that was previously auto-rejected after fixing an earlier step’s file, causing a rejected command to run without user approval

[Juan_Garcia]

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

If you have several steps with checklists where you need to approve commands before they’re executed, when the first one runs-let’s call it A-and you notice an error, then when it asks you to approve command B (the one after A), you tell it to fix something in the file generated by command A. Automatically, without you doing anything, the run of command B gets rejected (Cursor is the one rejecting it).

When Cursor fixes the file generated by command A, command B runs automatically even though you haven’t approved it. In the screenshot you can see it marked as “rejected,” but later on it executes without asking for permission.

Steps to Reproduce

1. Start a new AI task in Cursor

   • Ask Cursor to perform a multi-step operation that produces a checklist of commands (at least two steps).
   • Example: “First generate file foo.ts with X content, then update bar.ts to import from foo.ts.”

2. Make sure checklist commands require approval

   • In the checklist UI, confirm that each command (A, B, …) is in the “pending approval” state (i.e., Cursor will ask you to approve each before running).

3. Approve and run the first command (Command A)

   • Click Approve / Run on the first checklist item.
   • Let Cursor finish running Command A, which creates or edits a file (this is the file that will later have an error).

4. Wait for Cursor to ask to run the next command (Command B)

   • After A finishes, Cursor will prompt you to approve Command B (the next item in the checklist).
   • Do not approve B yet. Leave it in the “waiting for approval” state.

5. Instead of approving B, ask Cursor to fix an error in the file from A

   • In the chat or inline, tell Cursor something like:

     “There’s an error in the file you just generated with step A. Please fix it.”

   • Let Cursor run its own edit / fix operation on that file (outside of the checklist command B).

6. Observe that Command B is automatically rejected by Cursor

   • While Cursor is doing the fix, the checklist item for Command B will change to Rejected (without you clicking Reject).

7. After the fix is done, observe Command B running automatically

   • Once Cursor finishes fixing the file from A, Command B starts executing automatically.
   • You never clicked Approve for B, and in the UI it is still marked as Rejected, yet the command runs anyway.

8. Confirm visual + behavioral mismatch

   • In the checklist: Command B shows status “Rejected”.
   • In the logs / terminal / file changes: the actions from Command B have actually been executed without an explicit approval.

That’s the bug:

A checklist command that was automatically rejected by Cursor later runs without user approval, while the UI still shows it as Rejected.

Expected Behavior

Agent should ask permission to run command if you haven’t replied yet

Screenshots / Screen Recordings

Operating System

MacOS

Current Cursor Version (Menu → About Cursor → Copy)

Version: 2.0.77 (Universal)
VSCode Version: 1.99.3
Commit: ba90f2f88e4911312761abab9492c42442117cf0
Date: 2025-11-13T23:10:43.113Z
Electron: 37.7.0
Chromium: 138.0.7204.251
Node.js: 22.20.0
V8: 13.8.258.32-electron.0
OS: Darwin arm64 24.6.0

For AI issues: which model did you use?

Sonnet 4.5

Does this stop you from using Cursor

No - Cursor works, but with this issue

[deanrie]

Hey, thanks for the report. This behavior is definitely concerning, because a rejected command should not run without your confirmation.

It looks like this might be a state management issue in the agent’s checklist.

Please share the Request ID for this interaction:

• In the chat, click the context menu (top right) → Copy Request ID

This will help the team understand exactly what happened during the workflow state change.

[Juan_Garcia]

Hello Dean, thank you for your response,
Here is the requested ID: af48f98d-0f60-4f32-9fc5-6b88db9328cd

And just to make sure, I would not say “rejected” in a sense of me rejecting it but at least “not accepted” because I didn’t either accept or reject the command, it did automatically.

Thank you again