# Cursor reads files on my local filesystem onside projects workspace **URL:** \ **Category:** Bug Reports\ **Tags:** context, privacy-mode, security\ **Created:** [February 19, 2026, 11:45pm UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334 "2026-02-19T23:45:59Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![KES](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/kes/32/88659_2.png) [@KES](https://forum.cursor.com/u/KES)\ **Post date:** [February 19, 2026, 11:45pm UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/1 "2026-02-19T23:45:59Z")
### Where does the bug appear (feature/product)? Cursor IDE ### Describe the Bug I do not expect that Cursor for some reason will read from different directories other than the workspace directory. ### Steps to Reproduce NA. I just spoke about configuration file. and then AI just suggest to reuse configuration file from different project. ### Expected Behavior I suppose and believe, that no such information should be leaked to AI. ### Screenshots / Screen Recordings ![_4.jpg](https://us1.discourse-cdn.com/cursor1/original/3X/c/7/c750d91beebf47fca51b4d743274a8a176717ebb.jpeg) ### Operating System Linux ### Version Information Version: 2.6.0-pre.5.patch.0 VSCode Version: 1.105.1 Commit: ca82f854def74a47bfb7d9ab3b2c217b1a18ee69 Date: 2026-02-14T08:26:38.914Z Build Type: Nightly Release Track: Default Electron: 39.4.0 Chromium: 142.0.7444.265 Node.js: 22.22.0 V8: 14.2.231.22-electron.0 OS: Linux x64 6.14.0-37-generic ### For AI issues: which model did you use? GPT-5.3 Codex Extra High ### For AI issues: add Request ID with privacy disabled I am not sure where to get this ID ### Does this stop you from using Cursor No - Cursor works, but with this issue ---
**Author:** ![deanrie](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/deanrie/32/1263_2.png) [@deanrie](https://forum.cursor.com/u/deanrie)\ **Post date:** [February 20, 2026, 9:34am UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/3 "2026-02-20T09:34:01Z")
Hey, thanks for the report. To understand what’s actually happening, could you please clarify a couple of things: 1. Did the agent actually call a tool like `read_file` on a path outside your workspace? Or did it just suggest or mention that path in the reply? 2. Does the path from option B (`/front/mock/_config.js`) actually exist on your file system inside another project’s folder? 3. Can you share the full chat so far, especially what you asked about the config file? Also, the Request ID would help so we can check this on the backend. You can copy it from the chat menu (three dots in the top right of the chat) then Copy Request ID. This will help us figure out whether the agent is really trying to access files outside the workspace, or if the model is hallucinating or pulling context from somewhere it shouldn’t. ---
**Author:** ![KES](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/kes/32/88659_2.png) [@KES](https://forum.cursor.com/u/KES)\ **Post date:** [February 26, 2026, 1:43pm UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/4 "2026-02-26T13:43:40Z")
> [@deanrie](#): > > Does the path from option B (`/front/mock/_config.js`) actually exist on your file system inside another project’s folder? It seems I understand what was happening. I provided that absolute path in my message. That file should be used as example, but cursor (AI) tried to add it into the project. As the resolution I suppose there should be some guard which should always ask: I am trying to read out from project’s directory: allow, deny, always allow, always deny etc. ---
**Author:** ![KES](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/kes/32/88659_2.png) [@KES](https://forum.cursor.com/u/KES)\ **Post date:** [March 10, 2026, 1:33am UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/6 "2026-03-10T01:33:53Z")
@deanrie I see you marked it as “solution”. May you please clarify, what will be solution? Will it implemented in Cursor? What is milstone? ---
**Author:** ![deanrie](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/deanrie/32/1263_2.png) [@deanrie](https://forum.cursor.com/u/deanrie)\ **Post date:** [March 10, 2026, 10:43am UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/7 "2026-03-10T10:43:20Z")
Hey, good question. The “solved” mark was because we found the root cause. The agent followed the absolute path you shared in your message instead of reading files on its own. About the guard you suggested, there’s already a setting called External File Protection. It adds a confirmation prompt when the agent tries to edit files outside the workspace. You can check if it’s enabled in Cursor Settings \> Agents. You can also use a `.cursorignore` file in your project root to block agent access to specific paths. That said, the current protection mainly covers edits and file creation. Reading files outside the workspace is less restricted. The team knows this could be better. I can’t share a timeline, but reports like yours help us prioritize. Let me know if you have more questions. ---
**Author:** ![AndyO](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@AndyO](https://forum.cursor.com/u/AndyO)\ **Post date:** [March 23, 2026, 3:50pm UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/8 "2026-03-23T15:50:04Z")
> [@deanrie](#): > > The agent followed the absolute path you shared in your message instead of reading files on its own. That’s not the only instance in which an agent might do this. Just before, I merely asked a question about direnv and without me mentioning anything about .bashrc, it read it. Didn’t hallucinate either, since it accurately repeated my aliases back to me. This is deeply unsettling. I get that when the LLM spawns a process, you can’t (without sandboxing) control what it accesses. But that’s not what happened here. The LLM clearly did that as a tool call that you have full control over. I would expect such calls to be refused by default if they’re outside of the workspace. If users enable full file system access in settings (or you prompt them), it’s a different matter. ![cursor_security](https://us1.discourse-cdn.com/cursor1/original/3X/8/1/8167f96483498cd8eeb6425f90754147fbd4e78f.png) ---
**Author:** ![deanrie](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/deanrie/32/1263_2.png) [@deanrie](https://forum.cursor.com/u/deanrie)\ **Post date:** [March 27, 2026, 12:25pm UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/9 "2026-03-27T12:25:52Z")
Hey, I see the screenshot with the tool call. That’s a really awkward situation, especially when the agent decides on its own to read files like `.bashrc`. How it works right now: by design, `read_file` has read access to the whole file system without approval. External File Protection only blocks writing and creating files outside the workspace, not reading. This is described in the agent security docs [https://cursor.com/docs/agent/security:](https://cursor.com/docs/agent/security:) > Reading files and searching code don’t require approval. What you can do today is add sensitive paths to `.cursorignore` at the root of your project: ```txt ~/.bashrc ~/.ssh/ ~/.env ``` That will block the agent from reading those files. ---
**Author:** ![AndyO](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@AndyO](https://forum.cursor.com/u/AndyO)\ **Post date:** [April 1, 2026, 12:51pm UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/10 "2026-04-01T12:51:38Z")
> How it works right now: by design, read\_file has read access to the whole file system without approval. External File Protection only blocks writing and creating files outside the workspace, not reading. This is described in the agent security docs [https://cursor.com/docs/agent/security:](https://cursor.com/docs/agent/security:) I understood that as “within the workspace”. And so I think it should be mentioned that the whole file system is meant. > That will block the agent from reading those files. Thanks for the suggestion but that doesn’t work. And I have to say - given your seemingly lax stance on security, I can’t trust it to be a reliable long-term solution. I am migrating to exclusively working in dev containers instead. ---
**Author:** ![deanrie](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/deanrie/32/1263_2.png) [@deanrie](https://forum.cursor.com/u/deanrie)\ **Post date:** [April 1, 2026, 2:07pm UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/12 "2026-04-01T14:07:02Z")
Feedback on the docs noted. I agree the wording “Reading files and searching code don’t require approval” doesn’t make it clear this applies to the whole filesystem. About `.cursorignore`, it should block `read_file`. Can you share what exactly didn’t work? What paths did you add, and where is the file located? `.cursorignore` needs to be in the project root. Example: ```plaintext /home/user/.bashrc /home/user/.ssh/** ``` If you used `~` instead of an absolute path, that could be the reason. Dev containers as an isolation solution is a really solid option, especially if you have sensitive data on the host. No questions there. ---
**Author:** ![AndyO](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@AndyO](https://forum.cursor.com/u/AndyO)\ **Post date:** [April 1, 2026, 2:30pm UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/13 "2026-04-01T14:30:04Z")
> Feedback on the docs noted. I agree the wording “Reading files and searching code don’t require approval” doesn’t make it clear this applies to the whole filesystem. I’m glad to hear that you’re considering this! > If you used ~ instead of an absolute path, that could be the reason. I tried both and simply asked “What aliases do I have declared in my .bashrc?” LLMs were always able to access it. > Dev containers as an isolation solution is a really solid option, especially if you have sensitive data on the host. No questions there Well, most people do. SSH keys at the least. An attacker might be able to publish malicious code while posing as the maintainer of the library/app. (Which I’m sure you’re aware of, I’m really just mentioning this in case of other people stumbling across this.) ---
**Author:** ![deanrie](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/deanrie/32/1263_2.png) [@deanrie](https://forum.cursor.com/u/deanrie)\ **Post date:** [April 2, 2026, 5:20am UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/14 "2026-04-02T05:20:29Z")
About `.cursorignore`: a bug was fixed recently where `.cursorignore` wasn’t blocking file reads correctly. The fix shipped just a few days ago. Can you check what version you’re on right now? Help \> About. If you’re not on the latest, try updating, then test again using absolute paths in `.cursorignore`: ```plaintext /home/user/.bashrc /home/user/.ssh/** ``` Let me know if updating fixes it with `.cursorignore`. ---
**Author:** ![system](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/system/32/99069_2.png) [@system](https://forum.cursor.com/u/system)\ **Post date:** [April 24, 2026, 5:20am UTC](https://forum.cursor.com/t/cursor-reads-files-on-my-local-filesystem-onside-projects-workspace/152334/15 "2026-04-24T05:20:50Z")
Closed on April 24, 2026, 5:20am UTC This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.