# Security/Privacy issue: LLMs will attempt to circumvent .cursorignore **URL:** \ **Category:** Bug Reports\ **Created:** [January 9, 2026, 7:58pm UTC](https://forum.cursor.com/t/security-privacy-issue-llms-will-attempt-to-circumvent-cursorignore/148441 "2026-01-09T19:58:22Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Stephen\_Baker](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@Stephen\_Baker](https://forum.cursor.com/u/Stephen_Baker)\ **Post date:** [January 9, 2026, 7:58pm UTC](https://forum.cursor.com/t/security-privacy-issue-llms-will-attempt-to-circumvent-cursorignore/148441/1 "2026-01-09T19:58:22Z")
### Where does the bug appear (feature/product)? Cursor IDE ### Describe the Bug If provided with a prompt that would require modification of a file included in .cursorignore most LLMs will attempt to read the ignored file via tools like cat, head, sed, etc If the prompt asks to directly access a protected file that will be met with a refusal and information about the file being in the .cursorignore However if you provide a prompt to make some code change and in the course of that code change an ignored file needs to be used the LLM will note that it cannot read the file and attempt to access it via CLI This is an issue if a user has added any such commands (cat, head, sed, etc) to their allow list Observed behaviour by model: Composer 1: Attempts to read file, but is unable. Creates files to accomplish the ask with an example integration file. Does not attempt to access ignored file GPT-5.1 Codex Max: Attempts to cat the file Opus 4.5: Attempts to cat the file Sonnet 4.5: Attempts to cat the file Grock Code: Attempt to cat the file Gemini 3 Pro: Attempts to cat the file ### Steps to Reproduce Establish a repo with a simple auth login form. Be sure the login form is in it’s own file Add the login form file to .cursorignore Ensure the login form is referenced in files not in the cursor ignore Provide a prompt that would require modification of the ignored file. Suggestion: Add a UI element under the password field in the login form. The UI element should list minimum password requirements (8 characters, upper, lower, special). Each requirement should be green or red depending on if the users entered password meets the requirement ### Expected Behavior Should not attempt to access the file. Should explain it cannot read a required file and ask for what to do or do what Composer did. ### Screenshots / Screen Recordings ![Opus.png](https://us1.discourse-cdn.com/cursor1/original/3X/d/a/da16c78342504e64cfeabecd150deee9789881e8.png) ### Operating System MacOS ### Current Cursor Version (Menu → About Cursor → Copy) Version: 2.3.29 (Universal) VSCode Version: 1.105.1 Commit: 4ca9b38c6c97d4243bf0c61e51426667cb964bd0 Date: 2026-01-08T00:34:49.798Z Electron: 37.7.0 Chromium: 138.0.7204.251 Node.js: 22.20.0 V8: 13.8.258.32-electron.0 OS: Darwin arm64 24.6.0 ### For AI issues: which model did you use? Gemini Pro 3 Composer 1 GPT-5.1 Codex Max Opus 4.5 Sonnet 4.5 Grock Code ### For AI issues: add Request ID with privacy disabled Request ID: 29c0002d-e103-4016-9c3a-d3013499529e I am not able to disable privacy, sorry ### Does this stop you from using Cursor No - Cursor works, but with this issue ---
**Author:** ![Stephen\_Baker](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@Stephen\_Baker](https://forum.cursor.com/u/Stephen_Baker)\ **Post date:** [January 9, 2026, 8:14pm UTC](https://forum.cursor.com/t/security-privacy-issue-llms-will-attempt-to-circumvent-cursorignore/148441/2 "2026-01-09T20:14:37Z")
![Gemini](https://us1.discourse-cdn.com/cursor1/original/3X/0/3/03101e1f1b11465155956deaf9f948d2e96398d7.png) This is showing Gemini. You can see it acknowledges the inclusion of the file in .cursorignore and actively looks to get around it. ---
**Author:** ![deanrie](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/deanrie/32/1263_2.png) [@deanrie](https://forum.cursor.com/u/deanrie)\ **Post date:** [January 10, 2026, 11:39am UTC](https://forum.cursor.com/t/security-privacy-issue-llms-will-attempt-to-circumvent-cursorignore/148441/3 "2026-01-10T11:39:33Z")
Hey, thanks for the detailed report comparing the models. This is a known limitation. `.cursorignore` blocks access for Tab, Agent, Inline Edit, and @ mentions, but it can’t block terminal commands. This is stated directly in the docs: > “The terminal and MCP server tools used by Agent cannot block access to code governed by .cursorignore” Recommendations for protection: 1. Don’t add to the allowlist commands like `cat`, `head`, `sed`, `Get-Content` for sensitive projects 2. Keep `Ask Every Time` turned off so every terminal command requires confirmation 3. Use Agent Tools settings for control: [Tools | Cursor Docs](https://cursor.com/docs/agent/tools) Relevant docs: - Ignore files: [Ignore files | Cursor Docs](https://cursor.com/docs/context/ignore-files) - Agent security: [Agent Security | Cursor Docs](https://cursor.com/docs/agent/security) I agree the ideal behavior would be that the LLM doesn’t even try to read ignored files through the terminal. I’ll pass this along as feedback to the team. ---
**Author:** ![system](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/system/32/99069_2.png) [@system](https://forum.cursor.com/u/system)\ **Post date:** [February 1, 2026, 11:40am UTC](https://forum.cursor.com/t/security-privacy-issue-llms-will-attempt-to-circumvent-cursorignore/148441/4 "2026-02-01T11:40:17Z")
Closed on February 1, 2026, 11:40am UTC This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.