Sandbox shell command runs with network permission without asking

[Jack_Williams1 (Jack Williams)]

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

A model decides that the shell command it is running needs network access. Intermittently the command is ran without actually asking me, despite having configured the Auto-Run Network Access to Ask Every Time.

In this case I captured, I changed the Auto-run Mode setting to Auto-run in sandbox from Ask Every Time while this conversation existed, so it’s possible that is part of the bug.

See in the screenshot below, the second brew install ran without asking me permission. I have witnessed this before.

Steps to Reproduce

I’m not sure

Expected Behavior

I should always be asked permission before running network permission tools.

Screenshots / Screen Recordings

Operating System

MacOS

Version Information

Version: 2.4.36 (Universal)
VSCode Version: 1.105.1
Commit: f9919bf991f247689f9ead605b5c5a3239a2a790
Date: 2026-02-12T21:00:33.976Z
Build Type: Stable
Release Track: Default
Electron: 39.2.7
Chromium: 142.0.7444.235
Node.js: 22.21.1
V8: 14.2.231.21-electron.0
OS: Darwin arm64 25.2.0

For AI issues: which model did you use?

sonnet-4.5 thinking

For AI issues: add Request ID with privacy disabled

71828a76-ebc3-4975-a571-230d6be3ba2d

Additional Information

Privacy mode is probably enabled on my account. I have no control over that setting.

Does this stop you from using Cursor

No - Cursor works, but with this issue

[deanrie]

Hey, thanks for the report. This looks like a real bug. The “Ask every time” network access setting should always prompt for confirmation before giving network access to sandboxed commands.

The detail that you changed the auto-run mode in the middle of the conversation is helpful. It’s possible the permission state isn’t syncing correctly when settings change during an active session. As a workaround, try starting a new chat after changing any auto-run or sandbox settings so they apply properly.

I’ve passed this to the team.

Let me know if this still happens in new sessions where the setting is already enabled from the start.