Since i updated every single command leads to my agent running dosens and dosens of background tasks one after the other. I even added agent rules refusing the ability to run background tasks, completely ignored.
I made a strict plan, detailing what I wanted the agent to do, it did what I asked, then spent 50mins running task after task after task without consent or explination. I ask it to alter a script, it alteres said script, then starts generating and running testing tools for my program in multipul agents at once, all against instruction and rules, something I explicitly forbade, I am more than capable of running my own damn tests.
My usage for the entire month has almost been completely used up in a week of 2-3 hours work a day due to this and im quite tired of this happening.
I cannot locate any setting or commands that enable or disable this behavior.
Hey, thanks for the report. The rules text won’t help here since the agent follows it best-effort, and it doesn’t block commands. The real switch is Auto-Run.
To make every terminal command and edit wait for explicit confirmation:
Cursor Settings > Agents > Auto-Run > set it to “Ask every time”.
After that, the agent can’t run tasks without your approval. You can also use the allowlist, denylist, and sandbox there if you want partial automation.
About “multiple agents at once” (sub-agents running tests in parallel). The model spawns them, and there isn’t a separate hard toggle to “disable all sub-agents” right now. A workaround that helped other users:
Thank you for the response, sorry for any delay, I did not notice the reply until now.
I have set scripts / PowerShell etc to ask every time, the issue is it seems to run them regardless, by launching them in a seprate agent instance/sandbox or background task.
I have to constantly monitor it, block it, correct it. Every restart it seems to once again ignore all rules, instructions and commands and go right back to running random unprompted tasks.
To give an example, i asked it to scrape a user function from another build i was working on and import it into the new one, quite litterly just copy a few scrips and add relevant reference points. Instead it decided to re-implement the entire function in an entirely different manor, ignoring part of the script entirely, then attempted to run 620+ tests in a “background task.” Something I noticed occurring after returning to my desk 20mins later. In this time it burned though over 10% of my usage, kept failing and retrying on its own without permission. I had to force stop every background process to get it to stop, launching python windows, background CMD tasks in multiple instances.
Since then the vast majority of my usage has been “do not do this, do not do that” on repeat, i had used at least 60% before this issue occurred, however since then my usage was almost completely used in 2-3 3 hour sessions due to this issue.
I will attempt to disable composer 2 as mentioned to see if this resolves the issue, its a shame as composer is my default prefered model.
Hey, thanks for coming back with details. What you’re describing, commands starting in the background or in a separate subagent even when Auto-Run is set to “Ask every time”, is more serious than just rules being ignored. With “Ask every time”, nothing should start without your approval, including subagents and background tasks. I want to verify this.
To dig in, please send:
A Request ID from one of the sessions where a command started in the background without asking. You can find it via the chat menu three dots in the top right > Copy Request ID.
Your Cursor version Help > About and confirmation that Auto-Run is set to “Ask every time”, not allowlist or sandbox mode.
If you catch it in the moment, a screenshot of the background task or the running process.
While we’re collecting this, there are two usage levers that actually reduce parallel runs:
In the model dropdown, turn off Auto.
Settings > Models, disable Composer 2 and pick one specific model.
No problem, It is possble the settings were not consistant, I did inspect and alter them inbetween prompts. I did reotate between “allowlist” and “ask every time,” attempting to change behavior.
Hey, thanks for the details and the Request ID. I checked the screenshots, and here’s the key clue: in your Run Mode settings it’s set to Allowlist, not Ask every time. In Allowlist mode, all commands in the list below run automatically without a prompt. That’s expected behavior for this mode, not a bug.
Also, you mentioned you were switching between allowlist and ask every time between prompts. That makes the behavior inconsistent, and it’s impossible to tell what actually happened in each session.
Let’s do a clean test:
Cursor Settings > Agents > Run Mode > set it to Ask every time and don’t change it for the whole session.
Work as usual. If a command still starts in the background or in a subagent without asking, grab a new Request ID right at that moment chat menu, three dots in the top right > Copy Request ID and send it here. Then we’ll have the exact case to investigate.
About the 620 tests and parallel runs: your allowlist only has read commands cd, ls, cat, grep, git status, etc. Those don’t run tests. The mass test runs come from subagents the model spawns. To stop that, there are a few options:
Settings > Agents > Subagents: there’s a dropdown called Explore subagent model. You can switch it from Composer 2 to Inherit from parent or a specific model. Note: this dropdown only controls the explore subagent. It does not cover generalPurpose subagents spawned via the Task tool, and those are usually the ones running tests.
The most reliable hard block is a subagentStart hook with permission: “deny” in ~/.cursor/hooks.json or .cursor/hooks.json in your project. The payload includes subagent_type, so you can block only generalPurpose and still allow explore. This is more reliable than text rules, which the agent follows best-effort. Docs: Hooks | Cursor Docs
You can also reduce usage by turning off Auto in the model dropdown and disabling Composer 2 in Settings > Models, then picking one specific model.
Thanks for the response, as suggested i created a hook with permission set to deny for anything other than explore, i also changed subagent to inherit from perant.
In the case of run mode the option ask every time no longer exists, i have allowlist, run everything or auto-review, as you asked me not to use allowlist i changed to auto-review.
I saw no calls for subagents in the windows at all, however after about 2mins…
As mentioned my usage for the month was almost entirely used up, this test used the small percentage i had left, as it only ran 2 alterations, i cannot be sure the issue is resolved, but this setting did show promise so far.
I really do apprecate the help.
The below image present itself when attempting to compair builds of the program to work out an issue, it clearly failed to run any subagents, though i dont know if this is an API usage issue or the hook working.
Hey, good news. Your hook is working as intended. The three blocks with the status “Couldn’t start” are the subagents the agent tried to spawn (marked “Auto”), and your deny rule blocked them before they started.
One important note: the model will still try to spawn subagents, that’s expected behavior, and the hook doesn’t change the attempt itself. But it stops them from starting, so bulk test runs and reviews simply don’t launch, and those were what ate most of your usage. You’ve closed the main source of the spend. A small amount still goes to the main agent’s thinking and planning (“Thought for 3s”, “Planning next moves”), but that’s nothing compared to dozens of parallel test runs.
Also, about Run Mode, since you noticed the option is gone. You’re right: “Ask every time” is no longer in current versions (3.6+). The modes now are Auto-review (default), Allowlist, Allowlist (with Sandbox), and Run Everything. Sorry for the confusion in my earlier advice, that was the old name.
Auto-review doesn’t ask for every command. It runs commands through an LLM classifier, auto-runs what it thinks is safe, and only asks for confirmation on risky ones. If you want it to ask on literally everything (the closest match to the old “ask every time”), switch to Allowlist and keep the list empty. Then anything not on the list will wait for your approval. Before, you had read commands in there, so some things ran automatically.
If you want to cut usage even more: in the model dropdown, turn off Auto, and in Settings > Models disable Composer 2 and pick one specific model.
When your monthly limit resets, run a normal session with this setup and let me know if the behavior stays the same. But based on your screenshot, the hook is doing its job.
Will do, though will be about 10 days before i can fully test it, been trying in “free usage” mode but not seeing it even attempt the behavior it was doing eariler.
