Grok combines commands and breaks allowlist auto-approval

Support Bug Reports
, , ,
1

The Agent tends to be overly aggressive by combining multiple commands into a single line. Because of this, the command fails to match the allowlist, prompting Cursor to treat it as a new command and ask for manual approval.

This happens frequently when using Grok. By contrast, Composer 2.5 doesn’t have this issue. It is able to follow the allowlist design and runs commands individually without violating the rules.

2

Hi there!

We detected that this may be a bug report, so we’ve moved your post to the Bug Reports category.

To help us investigate and fix this faster, could you edit your original post to include the details from the template below?

Bug Report Template - Click to expand

Where does the bug appear (feature/product)?

  • Editor, Tab & Chat (autocomplete, Composer, in-editor agent)
  • Terminal & commands
  • Models, pricing & API keys (availability, Auto/Max, BYOK/Bedrock)
  • MCP & tools
  • Cloud Agents & Automations (cursor.com/agents, scheduled/event)
  • BugBot & Code Review
  • Cursor CLI
  • Cursor Mobile
  • Remote (SSH / Dev Containers / WSL)
  • Account, billing & login
  • Something else…

Describe the Bug
A clear and concise description of what the bug is.

Steps to Reproduce
How can you reproduce this bug? We have a much better chance at fixing issues if we can reproduce them!

  1. …
  2. …
  3. …

Expected Behavior
What is meant to happen here that isn’t working correctly?

Screenshots / Screen Recordings
If applicable, attach images or videos (.jpg, .png, .gif, .mp4, .mov)

Operating System

  • Windows 10/11
  • MacOS
  • Linux

Version Information

  • For Cursor IDE: Menu → About Cursor → Copy
  • For Cursor CLI: Run agent about in your terminal
IDE:
Version: 2.xx.x
VSCode Version: 1.105.1
Commit: ......

CLI:
CLI Version 2026.01.17-d239e66

For AI issues: which model did you use?
Model name (e.g., Sonnet 4, Tab…)

For AI issues: add Request ID with privacy disabled
Request ID: f9a7046a-279b-47e5-ab48-6e8dc12daba1
For Background Agent issues, also post the ID: bc-…

Additional Information
Add any other context about the problem here.

Does this stop you from using Cursor?

  • Yes - Cursor is unusable
  • Sometimes - I can sometimes use Cursor
  • No - Cursor works, but with this issue

The more details you provide, the easier it is for us to reproduce and fix the issue. Thanks!

6

Hey @Siu_Yee_Cheng, thanks for the report.

What you are seeing is how the allowlist is designed to work, combined with how Grok likes to write commands. The allowlist is matched per command, not per line. So a line like cd api && npm test | tail -20 will only auto-run if cd, npm and tail are each on your allowlist. If any one of them is missing, the whole line asks for approval. Grok tends to pack more small helper commands (cd, echo, head, tail, grep) into one line than Composer does, so it trips this more often.

A few things that should cut the prompts down a lot:

  1. When the approval card appears, open the “Always run” option. It lists exactly which commands were not on the allowlist. Adding those (they are usually harmless helpers like cd, echo, head, tail, grep, wc, ls) means the same chained line auto-runs next time.
  2. Add a User Rule (Cursor Settings > Rules) such as: “Run one shell command per tool call. Do not chain commands with && or pipes unless the task requires it.” Grok follows this well and it keeps each command matchable on its own.
  3. If you are on a local (non SSH) workspace, try Run Mode “Allowlist (with Sandbox)” in Cursor Settings > Agents > Execution and Approvals. Commands the sandbox can contain auto-run without needing to be allowlisted, and only the rest fall back to the allowlist.

If it still prompts for a line where every command is already on your list, could you send a screenshot of the approval card (it shows a “Not in allowlist: …” line) together with the entries you have on the allowlist? That would let us check whether something else in the command (a redirect, a heredoc, a subshell) is what is blocking the match.