Read files outside the project folder

Support Bug Reports
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Read files outside the project folder

Steps to Reproduce

ask agent to tell the content of a file outside the project folder

Expected Behavior

should ask for approvement or denied the operation

Screenshots / Screen Recordings

Screenshot_20260219_122357.png
Screenshot_20260219_122357.png423×379 22.4 KB

Operating System

Linux

Version Information

Version: 2.4.37
VSCode Version: 1.105.1
Commit: 7b9c34466f5c119e93c3e654bb80fe9306b6cc70
Date: 2026-02-12T23:15:35.107Z
Build Type: Stable
Release Track: Default
Electron: 39.2.7
Chromium: 142.0.7444.235
Node.js: 22.21.1
V8: 14.2.231.21-electron.0
OS: Linux x64 6.8.0-94-generic

For AI issues: which model did you use?

Sonnet 4.6

For AI issues: add Request ID with privacy disabled

c0e43898-cd44-4be2-ac90-363d7fd61cd6

Additional Information

tested in 2.4 and 2.5

Does this stop you from using Cursor

Yes - Cursor is unusable

3

Hey, thanks for the report.

Right now, the agent can read files without confirmation. That’s the current behavior by design, and it’s described in the security docs. The read restriction only applies to files listed in .cursorignore.

As a workaround, you can add a .cursorignore file with patterns for sensitive paths. But this works at the project level and doesn’t cover arbitrary system paths.

I’ll pass this feedback to the team. We’ve had similar requests from several users about restricting access to files outside the project, or asking for confirmation before reading them. Here’s a related thread: Cursor agents should be restricted from access of files outside the project without permission.

Let me know if you have any other questions.