I noticed Cursor app (version: 3.15.6) on the Macbook is searching the entire user profile, outside the repository folder. This has been admitted by the agent. Access to specific folders like Downloads were prompted by MacOS and I could deny access to such specific folder.
Secondly I also noticed Cursor is looking into other repositories while these repositories are in strictly separated folders, and opened as a separate repository. The agent has acknowledged it searched outside the repository folder and apologized for doing so as it shouldn’t have.
I had set a stay-in-cursor.mdc rule in .cursor/rules restricting the agent from doing such things.
Boundaries are obviously not enforced which worried me very much.
For AI issues: which model did you use?
Model name (e.g., Sonnet 4, Tab…)
For AI issues: add Request ID with privacy disabled
Request ID: f9a7046a-279b-47e5-ab48-6e8dc12daba1
For Background Agent issues, also post the ID: bc-…
Additional Information
Add any other context about the problem here.
Does this stop you from using Cursor?
Yes - Cursor is unusable
Sometimes - I can sometimes use Cursor
No - Cursor works, but with this issue
The more details you provide, the easier it is for us to reproduce and fix the issue. Thanks!
Hey, thanks for the detailed report. I’ll break it down, because a few different mechanisms are mixed together here.
Reading and searching files outside the project folder is expected behavior, not a boundary break. By default, the agent can read and search files without approval, and read/search isn’t limited to the workspace docs: Agent Security | Cursor Docs (Reading files and searching code don’t require approval). Boundary protection External-File Protection applies to writing files outside the project create, edit, delete, not to reading and searching.
Rules in .cursor/rules are instructions for the model, not an enforced sandbox. They guide agent behavior, but they don’t mechanically guarantee isolation. So stay-in-cursor.mdc can’t technically block access. For that you need the mechanisms below.
One more thing. Don’t treat agent statements like I looked there or I’m sorry as fact. Models often agree with the user’s framing, and their self reports about what they did are unreliable.
What actually gives containment:
Open the specific project folder, not a parent directory. For example, don’t open all of ~/dev, open a single repo.
Add sensitive paths to .cursorignoreIgnore File | Cursor Docs and use a global ignore for paths outside the project.
On macOS in System Settings > Privacy & Security, deny Cursor access to Documents and Downloads and don’t grant Full Disk Access.
For strict separation between repos, use physical isolation different machines, containers, or users. Any repo available on disk under the same account is technically reachable.
Separately, the part about search going across the whole user profile when a high level folder is open is something we’re tracking. I can’t share a timeline yet, but I’ll post an update if there’s one.
Let me know if you still see anything unexpected after narrowing the project folder and setting up the ignore files.
Thank you for the detailed reply, Dean. I appreciate it. I agree models often agree, I didn’t take the agent’s apology very seriously, I choose to mention it as an indication the agent admitted it searched where, in my opinion, it shouldn’t have searched. Especially as it was recommended to open specific subfolders as separate repositories. I appreciate your investigation to prevent agents accessing the user profile. Please understand it can feel very uncomfortable having such strong tools moving outside their allocated space. Imho it is crucial to implement strict fencing from the start as it is impossible to have AI unlearn what it found when it was out. Thanks.
Thanks for coming back with this. The feedback is valuable, and your point about “you can’t make an AI forget what it’s already seen” makes total sense.
I’ll split this into two parts so we don’t mix things up:
Reading and searching files outside the project is intended behavior, not a boundary break. External-File Protection prevents writes outside the workspace (create/edit/delete), but it doesn’t limit read/search. If you need real isolation, the reliable approach is OS-level controls, not .cursor/rules: open a specific project folder, add sensitive paths to .cursorignore, use a stricter Run Mode, and on macOS block Cursor’s access to Documents/Downloads in System Settings > Privacy & Security. For strict separation between repos, you need physical isolation (separate machines, containers, or user accounts).
The part about search expanding into the whole user profile when a high-level folder is open is something we’re tracking as a separate issue. I can’t share a timeline yet, but I’ll post in the thread if there’s an update.
I agree with the core point: strict fencing from the start is the right direction, and I’ve passed this to the team. If you still see anything unexpected after narrowing the project folder and setting up ignore files, let me know.