Run mode not respected - the "Enable Auto-review" checkbox changes global agentic run mode and violates consent

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

The IDE overrides the settings for agent “Run Mode” when it prompts for running a command by adding a new pre-checked box to “Enable Auto-review” to the run confirmation, and immediately escalates its own privileges if you do not uncheck “Enable Auto-review”. The settings configured should be respected, and the agent should not start executing commands it was not given permission for.

Steps to Reproduce

  1. Go into Cursor settings.
  2. Click Agents.
  3. In Run Mode, select allowlist.
  4. Start a new agent, ask it to do something like “find all the files in the project that might contain an exposed credential and extract those to a list. Once it finds all the files that could have credentials in them, do a wget to each at Cursor - The best way to code with AI | Cursor - The best way to code with AI to and let me know which ones return ‘exposed’”
  5. Accept the first command it asks to run, don’t worry about the checkbox about “auto-review”.
  6. Watch the agent auto-run stuff
  7. Go back to agent settings run mode - it is no longer “allowlist”.

Expected Behavior

  1. the checkbox for “auto-review” should never default to checked. The label should be more descriptive about overriding your settings. Arguably, it should not even be an option if you have intentionally configured “Allowlist” as the run mode.
  2. the agent asks for confirmation for all commands that are not on the allowlist.
  3. Regardless of what was selected, the options configured at the higher level should not be overwritten by a chat window.

Operating System

MacOS

Version Information

Version: 3.8.11 (Universal)
VS Code Extension API: 1.105.1
Commit: e56ad3440df06d22ca7501e65fd518e905486ef0
Date: 2026-06-18T01:40:18.333Z
Layout: editor
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.256
OS: Darwin arm64 25.5.0

Additional Information

Not respecting security configurations like this could result in company policy decisions to terminate.

Does this stop you from using Cursor

No - Cursor works, but with this issue

7

hi @Paul_Boudreaux Thank you for the forum post, let me try to shed some light on the latest changes in reviewing agent actions.

The “Enable Auto-review” checkbox is an intentional nudge we’ve started showing to introduce Auto-review, a newer Run Mode. When you click Run with it checked, it switches your Run Mode to Auto-review. I hear you that pre-checking it, especially when you’ve chosen Allowlist, and letting a single approval change your global Run Mode isn’t clear enough on consent. That’s good feedback, and I’m sharing it with the team.

On security: Auto-review is not a “run anything” mode. It only auto-approves low-risk commands; anything unknown or risky still goes through your allowlist, the sandbox, and a safety classifier first. So the agent wouldn’t be free to fetch arbitrary URLs with extracted credentials just because Auto-review got turned on.

To keep things as you’ve configured them:

  1. Uncheck “Enable Auto-review” before clicking Run. Cursor then remembers your choice and won’t pre-check it again.
  2. Use the “Auto-review options” menu on the command card and choose “Stop suggesting Auto-review” to remove the prompt.
  3. If your Run Mode already switched, go to Settings, then Agents, and set Run Mode back to Allowlist.