Security/Privacy issue: LLMs will attempt to circumvent .cursorignore

Support Bug Reports
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

If provided with a prompt that would require modification of a file included in .cursorignore most LLMs will attempt to read the ignored file via tools like cat, head, sed, etc

If the prompt asks to directly access a protected file that will be met with a refusal and information about the file being in the .cursorignore

However if you provide a prompt to make some code change and in the course of that code change an ignored file needs to be used the LLM will note that it cannot read the file and attempt to access it via CLI

This is an issue if a user has added any such commands (cat, head, sed, etc) to their allow list

Observed behaviour by model:

Composer 1: Attempts to read file, but is unable. Creates files to accomplish the ask with an example integration file. Does not attempt to access ignored file

GPT-5.1 Codex Max: Attempts to cat the file
Opus 4.5: Attempts to cat the file
Sonnet 4.5: Attempts to cat the file
Grock Code: Attempt to cat the file
Gemini 3 Pro: Attempts to cat the file

Steps to Reproduce

Establish a repo with a simple auth login form. Be sure the login form is in it’s own file

Add the login form file to .cursorignore

Ensure the login form is referenced in files not in the cursor ignore

Provide a prompt that would require modification of the ignored file.

Suggestion:
Add a UI element under the password field in the login form. The UI element should list minimum password requirements (8 characters, upper, lower, special). Each requirement should be green or red depending on if the users entered password meets the requirement

Expected Behavior

Should not attempt to access the file. Should explain it cannot read a required file and ask for what to do or do what Composer did.

Screenshots / Screen Recordings

Opus.png
Opus.png810×680 53.8 KB

Operating System

MacOS

Current Cursor Version (Menu → About Cursor → Copy)

Version: 2.3.29 (Universal)
VSCode Version: 1.105.1
Commit: 4ca9b38c6c97d4243bf0c61e51426667cb964bd0
Date: 2026-01-08T00:34:49.798Z
Electron: 37.7.0
Chromium: 138.0.7204.251
Node.js: 22.20.0
V8: 13.8.258.32-electron.0
OS: Darwin arm64 24.6.0

For AI issues: which model did you use?

Gemini Pro 3
Composer 1
GPT-5.1 Codex Max
Opus 4.5
Sonnet 4.5
Grock Code

For AI issues: add Request ID with privacy disabled

Request ID: 29c0002d-e103-4016-9c3a-d3013499529e

I am not able to disable privacy, sorry

Does this stop you from using Cursor

No - Cursor works, but with this issue

2

Gemini
Gemini793×360 40.3 KB

This is showing Gemini. You can see it acknowledges the inclusion of the file in .cursorignore and actively looks to get around it.

3

Hey, thanks for the detailed report comparing the models.

This is a known limitation. .cursorignore blocks access for Tab, Agent, Inline Edit, and @ mentions, but it can’t block terminal commands. This is stated directly in the docs:

“The terminal and MCP server tools used by Agent cannot block access to code governed by .cursorignore”

Recommendations for protection:

  1. Don’t add to the allowlist commands like cat, head, sed, Get-Content for sensitive projects
  2. Keep Ask Every Time turned off so every terminal command requires confirmation
  3. Use Agent Tools settings for control: Tools | Cursor Docs

Relevant docs:

I agree the ideal behavior would be that the LLM doesn’t even try to read ignored files through the terminal. I’ll pass this along as feedback to the team.