Cursor CLI installation gets blocked by Windows Defender

Support Help
, ,
1

I checked today that “agent” command is no longer avaliable to me. I went to Cursor CLI — Run Agents in Terminal, GitHub Actions and Automations & Scripts website and copied to powershell command. After I run it, windows defender screamed it’s a virus. “Trojan:Win32/Commando.A!ml”. What to do? I was using it without a problem.

5

Hey, thanks for the report. This is a Windows Defender false positive. The !ml suffix in Trojan:Win32/Commando.A!ml means it was flagged by an ML heuristic, not a real signature. Defender is reacting to the irm ... | iex pattern in PowerShell, since the same pattern is used by malicious ClickFix campaigns. The command using Cursor CLI — Run Agents in Terminal, GitHub Actions and Automations & Scripts is legitimate.

The agent command is probably missing because Defender quarantined the installed CLI. How to fix it:

  • Restore the file from quarantine: Windows Security → Virus & threat protection → Protection history → find the cursor-agent entry → Restore.
  • Update Defender: run Windows Update and update security intelligence. Last time the detection went away after a definitions update, and sometimes it comes back with new ones, so the database version really matters.
  • If it keeps happening, add an exclusion for %LOCALAPPDATA%\cursor-agent\ including the versions subfolder, then rerun the install command.
  • Optional: submit a false positive report to Microsoft to speed up a fix on their side: Submit a file for malware analysis - Microsoft Security Intelligence

We’re working on a more reliable install option that doesn’t use this script flow. Let me know if the CLI still won’t come back after the steps above.

6

I write powershell instead of CMD. I was trying to run the command on the CMD with adding a powershell prefix and wrapping your install commands with double quotes. Normally this make the code run without a problem but in this instance defender fires as virus. I run the command directly on the powershell and it worked. No problem so far. But if you can add pnpm installation it would be better and safer and easier.

8

Glad it’s working, and thanks for coming back with details. That’s helpful for other users.

What you noticed makes sense. Running it via CMD with a PowerShell prefix and wrapping it in double quotes changes how the command looks to the system, and Defender’s ML heuristic flags that exact pattern. Running it directly in PowerShell irm 'https://cursor.com/install?win32=true' | iex is the recommended way, so you did the right thing.

On installing via pnpm or npm, I passed that along to the team as feedback. A more convenient and reliable install method without a script flow is something we’re working on, but I can’t share a timeline yet.

If the CLI disappears again, let me know.