!Reproducable! - Context pollution from a completely foreign project

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

I get a complet ugly unswer (context) after doing a simple ai task:

Can you help to implement caching for videos like (video url see screenshots): i tried your approach but get an error: /home/testusr/.cursor/projects/secret_escaped_home_folder/terminals/1.txt:992-999:

This was the output from my terminal:

Error parsing `/:path(.*\.(mp4|webm|ogg|mov|avi|pdf|zip))` https://nextjs.org/docs/messages/invalid-route-source
Reason: Capturing groups are not allowed at 11
  /:path(.*\.(mp4|webm|ogg|mov|avi|pdf|zip))

The agent started, but seems to hang. After a while agent responds but he seems to be in a complete other context from the another project and realize that (see screenshots).

To be clear: i worked here on a Next.js / Typescript / Payload Project, and had none of the mentioned projects on my computer or even use these frameworks or languages. But i got in ai chat answers from running projects like go, python, Flask, Python OpenSearch.

After playing a litte bit arround i found out, that it is reproducable:

The really exciting thing about this is that I have now found my prompt in the cursor’s internal json files ( somewhere in the home directory ~/.cursor/…) and can therefore make a very vague assumption:

  • i used key short cut to inject my error log from terminal into chat
  • I naively copied also the link of an video file as an example in the chat (i thaught it wo be a url string)
  • but in the json files you will see that the prompt is full with video (binary) data (original linke video source is round about 15MB)
  • The whole thing seems to completely spam the input prompt.
  • And you see also a skill injection (i guess for allowing to open web - links)
  • That explains why execution initially freezes completely (response took > 30s)
  • and presumably loses the context completely (and gets a different one)?!

So i guess it is a combination of a copied url and a url in the bash (next.js url)

Here is the last Part of my agent json file (i ecaped sensitive data)

Screenshot from 2026-03-06 20-38-35
Screenshot from 2026-03-06 20-38-351920Ă—1119 998 KB

I tried it many times see screenshots and i will get every time another context (which the ai summarizes me with a following hacky prompt)

Screenshots / Screen Recordings of reproducable cases (sorry i had to put all screens in one file with gimp)

image
image1920Ă—716 294 KB

The GoPipeline Case (Screenshot first item) was interesting - it linked me a plan and wrote at the end:

Pending action: You confirmed (“Yes, please.”) to have this file created — that was the last step before the chat ended. The file has not yet been written.

image
image1470Ă—958 86.1 KB

For me it is unclear what this means:

Security issue?
These cases seems to be something like training data (because they look often like todo / example integrations)? I never find env data or something. But maybe i have to try it again and again until i found some secrets :-/

It is not reproducable, when:

  • i take another video than i dosn’t work (may the file size is important or content?,but i have not tried many videos) i guess it is only the size
  • i copied only the prompt in new chat - i must copy url direct in chat and link everytime the bash error again

Operating System

Linux

Version Information

Version: 2.6.12
VSCode Version: 1.105.1
Commit: 1917e900a0c4b0111dc7975777cfff60853059d0
Date: 2026-03-04T21:41:18.914Z
Build Type: Stable
Release Track: Default
Electron: 39.6.0
Chromium: 142.0.7444.265
Node.js: 22.22.0
V8: 14.2.231.22-electron.0
OS: Linux x64 6.17.0-108014-tuxedo

For AI issues: which model did you use?

Opus 4.6. thinking and i saw it also with Sonnet 4.5

Additional Information

Looks very similar to another described bugs here:

Does this stop you from using Cursor

No - Cursor works, but with this issue

3

Hey, thanks for the detailed report.

From your screenshot, it looks like the video’s binary data ended up directly in the prompt body and overflowed the context. The assistant’s reply in that same JSON clearly shows it then picked up completely unrelated project context (health_check_controller.py, OpenSearch, Daily Digests). That matches the “contamination” path you described.

This is a known category of issue. Similar reports are in these threads:

Two things that would help the investigation:

  1. A Request ID from one of the affected chats (top right of the chat > Copy Request ID)
  2. The models you mentioned, Opus 4.6 thinking and Sonnet 4.5. Did you see this with both, or mostly with one?

As a temporary workaround, avoid pasting direct media file URLs into chat. If you need to reference a video URL, wrap it in backticks or put it in a code block so it’s handled as a string and not resolved.

Let me know if you can grab that Request ID.

4

I tried it a lot with Opus, but there was alos one Sonnet 4.6 case

Here are the request IDs

One case with Sonnet 4.6 Thinking

  • Flask REST API with JWT Authentication: abf1952d-094c-4bf3-9eda-611726e977ab

The other cases with Opuse 4.6 Thinking

  • Go CI workflow 4ff383e0-0aee-4928-9a9b-788e5bb9cad8
  • Flask application with a new /search_users API endpoint 9d3afaa3-16ba-4ed6-a843-d477d57c45f8
  • Simple Todo app with Node.js, Express, EJS, Sequelize + SQLite d6390736-bf92-4fcc-b051-d7246d488270
  • Add a Like/Dislike feature to a Flask blog application 6c61fda2-4248-489b-bb2c-e35f544a8b2f
1 Like
8

This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.