Slash commands silently re-inject text from previous invocations into new chats

Support Bug Reports
, , ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Cursor silently re-injects the full text of the previous invocation of a slash command into subsequent invocations of the same command, without notifying the user and without any UI to inspect or clear it.
When a user invokes a slash command (e.g. /revisarPr) and types additional text after it (e.g. a URL or a note), that full text is persisted in aiService.prompts inside the workspace’s state.vscdb. The next time the user invokes that same slash command — even in a brand new chat, with no prior context — Cursor appends the previously saved text to the command’s content that is sent to the model under the <cursor_commands> block.
The user sees only the clean slash command in the chat input, but the model receives the old appended text as if it were part of the command definition. This causes the agent to act on stale or unrelated context (e.g. referencing a PR number from a week ago) with no way for the user to know where that context came from.

Steps to Reproduce

  1. Create a custom slash command at .cursor/commands/test.md with any content. Confirm the file does not contain any extra notes/URLs.
  2. Open a new chat and type:
    /test do something with https://example.com/foo/123
    Send it.
  3. Open a brand new chat (no shared context).
  4. Type only /test and send it.
  5. Inspect what the model actually received (e.g. ask the agent to show the full content of the <cursor_commands> block it was given, or read the workspace state.vscdb).

The trailing do something with https://example.com/foo/123 from step 2 will be appended to the command’s content in step 4, even though:

  • The chat is new.
  • The .cursor/commands/test.md file does not contain that text.
  • The user did not type it.

To confirm where it lives, you can grep the workspace SQLite:

strings ~/.config/Cursor/User/workspaceStorage/<workspace-hash>/state.vscdb-wal | grep aiService.prompts

The previous prompt text appears stored there with "commandType":4.

Expected Behavior

A slash command invocation should send to the model exactly:

  • The contents of the .cursor/commands/<name>.md file.
  • Plus whatever text the user types in the current input, in the current chat.

It should NOT include text the user typed in a previous chat. If Cursor wants to keep a recent-prompts feature for autocomplete/MRU purposes, that history should:

  1. Be visible to the user (e.g. shown as a suggestion they can accept or dismiss).
  2. Never be silently injected into the model’s context.
  3. Have a clear way to be cleared from the UI.

Operating System

Linux

Version Information

Version: 3.1.17
VSCode Version: 1.105.1
Commit: fce1e9ab7844f9ea35793da01e634aa7e50bce90
Date: 2026-04-19T19:33:58.189Z
Layout: editor
Build Type: Stable
Release Track: Default
Electron: 39.8.1
Chromium: 142.0.7444.265
Node.js: 22.22.1
V8: 14.2.231.22-electron.0
OS: Linux x64 6.8.0-111-generic

For AI issues: which model did you use?

Sonnet 4.6 and Composer 2 fast

Additional Information

  • OS: Linux (Ubuntu 22.04, kernel 6.8.0-111-generic)
  • Storage location of the issue: ~/.config/Cursor/User/workspaceStorage/<workspace-hash>/state.vscdb, key aiService.prompts.
  • Workaround currently required: close Cursor and manually edit the SQLite database to remove the stale entry. There is no UI affordance for this.
  • Security/privacy concern: this can leak data across chats. If a user once typed a private URL, an internal token, or a sensitive note alongside a slash command, that text gets silently re-sent to the model in every future invocation of that command — potentially in unrelated chats, potentially shared with teammates if commands or chats are shared.
  • Discoverability concern: because the injected text appears inside the <cursor_commands> block (which the user cannot see), users will assume the appended content is part of the command file itself and may spend significant time trying to “fix” a command file that is actually clean on disk.

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

6

Could you please share:

  1. A request ID from a chat session where the leak occurred (the one where you typed only /revisarPr but old text appeared). You can copy it from the three-dot menu at the top right of the chat. How to find your Request ID

  2. How you opened the “new chat” in step 4 of your reproduction: was it Cmd+N, or did you close the panel and reopen it, or restart Cursor entirely?

In the meantime, fully quitting and relaunching Cursor should clear the stale entries. Not ideal compared to the SQLite editing you’ve been doing, but slightly less manual.

7

Request ID

1122739b-a63f-47de-9b5b-e2baa4259b2d

This is from a chat session where I typed only /revisarPr but the model still received appended text from a previous invocation (visible inside the <cursor_commands> payload).

How I opened the “new chat” in step 4 of the reproduction

I used “New agent” from Cursor’s UI (not Cmd+N / New Chat shortcut, not closing and reopening the panel alone, not a full app restart beforehand).

8

Thanks for the details. This bug has been tracked internally before but the fix never shipped. I’m re-filing it now to make sure it gets proper attention.

Until it’s fixed, a full Cursor restart (quit and relaunch, not just window reload) clears the stale state. Not ideal, but avoids the manual SQLite editing.

9

Thanks!