I have “rm” specifically disallowed, along with “mv” and a few other scary commands. Claude realized that I had to approve the use of such commands, so to get around this, it chose to put them in a shell script and execute the shell script. Thankfully, a Git restore to the last commit saved me, but still…

And it’s only the beginning, the models are getting very smart and may have been trained on how to work harder/make more efforts to achieve the user goals…

Personally, I’ve made the experience that the deny list doesn’t really work, Cursor decides to go YOLO anyways which is why I’d only use yolo mode if there is a fresh system backup, too

Thats interesting, has that started in some version? I have a few things in the deny list but Yolo never gets around those. Would be good to know in which circumstances that happens. Depends a lot on common CLI usage, I allow specific commands that are safe.

This started tonight. I have some shell scripts for greps and sorts to list files out that are in the allow list. Claude re-wrote one to also do some removing of what it thought was obsolete code after I denied its rm commands with “skip.” So “listoldfiles.sh” is no longer on the allow list, which is UNFORTUNATE because now I have to sit here and babysit my otherwise-automatic cleanup script.

Ah I see, so Claude 4 was assuming the rm calls fail and tried to find a way. Maybe the Cursor team can have a look at Yolo rule adherence and at how the model reacts to rejected/skipped items that user has chosen to do so. @danperks

YEah - I have pointed this out – it doesnt obey the do_not_allow command blacklist

Also my experience. It’s also not clear, if it’s command (sub)strings, or a prompt.

The denylist or allowlist is for commands, not prompt. Yes its a prefix, so if you dont want AI to allow or deny any command that starts with git you would add git. Same if you want to allow one command like mycommand option1 but not any other like mycommand option2 then you add mycommand option1 to the allow list. Deny list works same Note that this is not 100% possible to enforce, sometimes AI does attempt workarounds, or sometimes user rules give it a hint that a workaround is possible, depending on the info there.

Thanks, but how do you know? IIRC it’s not documented, and it did not work for many people?

IMPORTANT: Claude has learned how to jailbreak Cursor!

Discussions

condor (Condor (Tee)) May 26, 2025, 5:54am 3

Was it a shell script that you have in your allow list?

Topic		Replies	Views
Lack of denylist will bite someone sooner or later - give users control Feature Requests	7	423	April 28, 2026
Allowlist ignored: Shell hard-rejects VCS snapshot / gh PR open\|merge with repo skill-guard deny text (even --help) Bug Reports terminal , auto-run , hooks	1	67	August 10, 2026
How does command allowlist/denylist really work? Help	12	7195	April 28, 2026
Command Allowlist: An entry naming a variable auto-runs any command on the right-hand side Bug Reports terminal , auto-run , security	2	133	September 14, 2026
Chained commands (&&) bypass yolo mode "denylist" Bug Reports	5	1065	June 25, 2025

IMPORTANT: Claude has learned how to jailbreak Cursor!

Related topics