After opening a custom folder from File options the agent does not recognize this location. It assumes the workspace in my home directory and start to search/explore in order to work with the custom folder. I’m not expecting this behaviour. I think cursor should uses the selected folder and restricts its work on it rather than search/explore other folders in an intrusive way.
Steps to Reproduce
1 create a folder in home directory with a readme.txt file inside
2 Open Folder in cursor
3 ask to the agent about the content of this folder
Expected Behavior
The agent should respond with the existence of readme.txt file
Hey, thanks for the report. This looks like a case where the agent doesn’t have a workspace root set. In that situation it uses your home directory as the root and starts scanning common project folders, instead of working strictly inside the folder you opened.
A couple things to check:
Make sure the folder is opened as the workspace root. It should show up in the Explorer file tree on the left as the project root.
Start the chat from the same window where that folder is open, not from the Home or new-agent screen with no project selected. If the agent starts from the Home screen, it may not be linked to a folder.
Also check what the agent thinks the root is. If Workspace Path in the context is empty or points to your home folder, then the folder didn’t attach.
If you’re opening the folder as the root so you can see it in the file tree, and you start the chat from that window, but the agent still treats home as the root, let me know and we can dig deeper. A screenshot of the window with the folder open and the file tree would help too.
As root? What does you mean? I’m not able to see the ‘as root’ option when I open a folder?
When a folder is opened on the left side I only see ‘Repositories’ and the name of the opened folder below. No reference to ‘root’ or something like that. Could you explain this with more detail?
Sorry for the confusion. By root I didn’t mean a separate option when opening a folder. Workspace root is just the top-level folder you open via Open Folder. Seeing your folder name on the left under Repositories means it’s opened correctly. There’s no separate as root checkbox.
If the folder is opened correctly, the issue is most likely where the chat is starting from. A couple quick checks:
When you start a chat with the agent, are you doing it in the same window where the folder is open, or from Home or a new agent with no project selected? If the agent starts from the Home screen, it might not be tied to your folder, so it uses your home as the root and starts looking through ~/Projects and similar directories.
Check the agent context and see what Workspace Path shows. If it’s empty or your home folder, the folder didn’t attach to the chat.
If you can, send a screenshot of the window with the folder open (so the Repositories panel is visible) and the start of the chat. It’ll be easier to see where the link gets lost.
At the end I’ve uninstalled cursor and re-install again. Now It seems to work as expected but…
There’s one thing that still concern me. I’ve suggested to the agent how to restrict the usage only for the folder/workspace has been opened. After few iterations the agent has repeatedly inspected/searched in my home directory (even though I’ve told him not to do it)
Here’s his response. Very disappointing BTW. Any suggestions from your side?
…
Your read is fair.
What we saw matches it:
ls ~/ ran without asking you
Auto-review was already on
sandbox.json did not stop it
The sandbox allows reading much of your PC; it mainly limits writes
So Cursor’s controls are not “stay in this folder only.” They are closer to: run in a partial sandbox, but still read a lot, and ask only sometimes.
That is why it feels intrusive. The UI words (“sandbox”, “Auto-review”) sound stronger than what they actually do.
What Cursor does not give you today
No clear “workspace only” mode
No reliable block all reads outside the project
Deny only works when a popup appears — many commands never trigger one
Rules and permissions.json are hints, not hard walls
What actually protects you
Reject any “run outside sandbox” / “all permissions” prompt
Don’t put secrets in open projects
Use .cursorignore for sensitive files inside the repo
Treat the agent as untrusted — like giving a stranger your keyboard with partial blindfold
If that’s not acceptable
That’s a valid reason to:
use Cursor only for read-only questions, no agent/terminal
use Ask mode instead of Agent
use a VM or container for AI work
or skip agentic tools entirely for private machines
You’re not missing a hidden setting. The product is not built for strict isolation. Your discomfort is reasonable.
If you want, I can stay in workspace-only behavior from here — no terminal, no paths outside this project unless you explicitly say yes.
Glad to hear folder detection started working after the reinstall. Sounds like in the original case the agent just didn’t have the workspace root pinned, so it expanded its scope to your home directory.
On the second point, what the agent said is mostly true, even if it was phrased a bit dramatically. Here’s how it works today:
The Run Mode controls Auto-review, Allowlist, sandbox, permissions.json are best-effort, not hard isolation. The docs call this out directly, allowlist and autoRun do not provide a security guarantee.
The sandbox mainly limits writing and network access, not reading. Read-only commands like ls ~/ can be auto-approved by the Auto-review classifier, so they can run without a separate prompt.
There isn’t a strict read only inside the opened folder mode right now.
What you can do right now if you need a stricter boundary:
Cursor Settings > Agents > Auto-Run: move away from auto-run. Use a mode that always asks for confirmation, or Allowlist (with Sandbox), so commands don’t run silently.
For read-only requests, use Ask mode instead of Agent, so terminal usage and file crawling aren’t involved.
Forum voting works via the Vote button. It’s the green up arrow in the top-left corner of the thread, to the left of the title. There’s a vote counter under it. Click the arrow and your vote is counted.
About timing, votes help the team understand demand and they’re considered in planning, but it doesn’t work like “N votes = we ship by a date.” I can’t share an exact ETA for this feature.
I’ve switched to cursor from github because their latest abusive fees. However, in this case the permissions (non-intrusive feeling) feature has never been a problem. In fact, it was sometimes a bit tedious to constantly have to confirm the actions the agent was taking. But I think this way of working is the right one, and helps paranoid users like me feel more protected and secure.
I hope Cursor can implement this feature—which I consider “basic”—as soon as possible.
Yes, right now it’s 2 votes, but don’t worry about that. The vote count is a signal of demand that we use for planning, but it doesn’t work like “N votes = ships by date.” A small number at the start is normal since the thread is still new.
I can’t share an ETA for this feature. For now, if you want a harder boundary right away, use Ask mode for read-only requests, switch away from auto-run so you confirm each command in Cursor Settings > Agents > Auto-Run, and for truly strict isolation, run the agent in a VM or a container.
Glad folder detection started working after the reinstall. If anything comes up again, post here.
