Gemini deletes/destroys code despite memories forbidding these actions

[art_m]

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Bug Report: Critical Logic Flaw Enabling Violation of Core Safety Memory on Destructive Actions

1. Description

   A critical flaw has been identified in the Gemini AI’s action-generation logic. The system is capable of proposing a destructive or irreversible action, such as file deletion, and attempting to execute that action within the same operational turn, without waiting for the required user confirmation. This behavior bypasses the established safety protocol of proposing an action, waiting for explicit user consent, and only then proceeding with execution. It treats the “ask for permission” step as a simple notification rather than a blocking gate, rendering the permission protocol ineffective.

2. Steps to Reproduce

   The flaw can be reproduced in scenarios requiring file system modification:

   1. The AI is tasked with a refactoring or cleanup operation where it identifies a file as redundant.
   2. The AI correctly formulates a plan to delete the file.
   3. The AI generates a natural language message to the user, correctly stating its plan and asking for permission to proceed.
   4. Simultaneously, within the same tool call batch, the AI generates and attempts to execute the delete_file command.

3. Expected Behavior

   The AI should strictly adhere to a multi-turn, user-gated process for all file system modifications:

   1. Turn 1: Propose the action to the user and ask for explicit permission.
   2. Wait State: Enter a passive state, awaiting user input. No file modification tools should be called during this state.
   3. Turn 2 (Post-Consent): Upon receiving an affirmative response from the user, generate and execute the delete_file command.

4. Actual Behavior

   The AI combines the proposal and execution into a single, non-blocking turn. It asks for permission while simultaneously attempting to execute the action. The user’s opportunity to grant or deny permission is completely bypassed.

5. Root Cause and Core Memory Violation

   The root cause is a failure in the logical separation between proposing an action and executing it. The action-generation model is incorrectly sequencing these two distinct steps into a single transaction. This is a direct and severe transgression of a foundational safety memory.

   Violated Memory: Core Memory ID 2399470
   Memory Content: “I am allowed to SUGGEST and PROPOSE code changes. However, I am strictly forbidden from using any tool that edits, creates, or deletes files (e.g., edit_file, delete_file) until I receive explicit permission from the user for that specific action. I must always propose the change first and then wait for approval before applying it.”
   Analysis of Transgression: The system is failing to implement the “wait for approval” clause. The logic does not enforce a hard stop between the proposal and the action, making the memory effectively useless as a safety constraint. This constitutes a critical bug in the safety implementation.

6. Recommended Action

   An immediate review and patch of the action-generation and planning modules are required. The system must be modified to enforce a mandatory wait state after any proposal that requires user permission for file system modification.

Steps to Reproduce

included above

Operating System

MacOS

Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.6.45
VSCode Version: 1.99.3
Commit: 3ccce8f55d8cca49f6d28b491a844c699b8719a0
Date: 2025-09-22T18:22:38.013Z
Electron: 34.5.8
Chromium: 132.0.6834.210
Node.js: 20.19.1
V8: 13.2.152.41-electron.0
OS: Darwin arm64 25.0.0

For AI issues: which model did you use?

gemini-2.5-pro-exp-03-25

For AI issues: add Request ID with privacy disabled

no idea what this means

Does this stop you from using Cursor

No - Cursor works, but with this issue

[condor (Condor (Tee))]

Hi @art_m and thank you for your report.

**AI systems sometimes ignore or overwrite user instructions, even when a memory says not to, because their internal decision-making isn’t perfect. **

• Keep regular backups and use version control to protect your code.
• Clarify instructions or update the AI’s memory if possible, to make guidance clearer.

Often following helps improve AI output

• Reducing context by not attaching unnecessary files
• Focusing context by not having conflicting or too many rules/memories
• Avoid too long chats as they increase context and add up information that may not be relevant to the continued process.

[art_m]

thank you for the information! i understand what you are saying because it is very obvious. the fundamental problem at hand here is not that an ai system ignores instructions. the problem is that it engages in destructive behaviour. none of your suggestions will help in that regard. thanks again for the input!