Kaspersky blocks Cursor from querying Windows registry

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

I’m getting security alerts from my Kaspersky antivirus indicating that Cursor is trying to write keys to the Windows registry.

Steps to Reproduce

Here is the anomaly message from my Kaspersky console (translated from French source system):
Event: Process action blocked
User: AC-NANTES\dtollet
User type: Initiator
Application name: node.exe
Application path: C:\Users\dtollet\AppData\Roaming\Cursor\User\globalStorage\anysphere.cursor-agent-worker\agent-cli.local\share\cursor-agent\versions\2026.09.23-86fc751
Rule: Start of Registry Editor from JScript script
Source process: c:\users\dtollet\appdata\roaming\cursor\user\globalstorage\anysphere.cursor-agent-worker\agent-cli.local\share\cursor-agent\versions\2026.09.23-86fc751\index.js
Source process hash: 4b50f729446ab8c3eb688b6b66af8ddf9fe236dbd8daade5d6dbdcc83f31c3dd
Target process: C:\Windows\System32\reg.exe
Target process hash: ef37663b44ac66920c6f33694deea01acb78ae3f3012884819373fa04c3eb5f0
Target object: object://cmdline:reg.exe query HKLM\SOFTWARE\Policies\Cursor\Cursor
Result description: Blocked
Type: Anomaly
Name: Start of Registry Editor from JScript script
Accuracy: Heuristic analysis
Object type: Process
Object name: index.js
Object path: C:\Users\dtollet\AppData\Roaming\Cursor\User\globalStorage\anysphere.cursor-agent-worker\agent-cli.local\share\cursor-agent\versions\2026.09.23-86fc751

Operating System

Windows 10/11

Version Information

Version: 3.21.9 (user setup)
VS Code Extension API: 1.128.0
Commit: 9998796a6096ce83d83a9332bfe7473b985db750
Date: 2026-09-17T02:16:48.732Z
Layout: IDE
Build Type: Stable
Release Track: Default
Electron: 42.10.0
Chromium: 148.0.7778.280
Node.js: 24.18.1
V8: 14.8.178.38-electron.0
xterm.js: 6.1.0-beta.291
OS: Windows_NT x64 10.0.26200

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hi,

Thanks for posting on the Cursor forum!

To help ensure most of our users can participate in discussions, this forum is currently English only.

If you’d like, you can edit your post to translate it into English. Once it meets our guidelines, it will be automatically relisted.

Thanks for understanding!

Note: This is an automated detection system and sometimes makes mistakes. If your post is already in English, feel free to ignore this message, or just make a small edit and it will be reviewed again.

8

Original post transleted to english. Please consider it.

9

Translation has been done. Please reactivate this post.

11

Hey @a658525722ff6e982429, thanks for the report and for including the full Kaspersky event.

Cursor isn’t writing anything to your registry. The blocked command is a read-only reg.exe query HKLM\SOFTWARE\Policies\Cursor\Cursor. Cursor’s background agent process uses it to check whether your organization has set a device sign-in policy for Cursor. When Kaspersky blocks it, Cursor just treats the machine as unmanaged and keeps working normally, so nothing breaks.

This process runs when Remote Control is turned on for this computer. To stop the alerts, either:

  1. Turn it off if you don’t use it: in the Agents Window settings, open Remote Control and switch off “Enable Remote Control for this computer”.
  2. Or ask your Kaspersky administrator to add an exclusion for the “Registry Editor start from JScript” rule for %APPDATA%\Cursor\User\globalStorage\anysphere.cursor-agent-worker\agent-cli\.local\share\cursor-agent\versions\*\ (use a wildcard, because the version folder changes on every update).