Two hours ago, the cursor completely formatted my C drive.
I usually use a MacBook, but today I sat down at the PC. I’ve already been working with the cursor on a PC for about the last three months. But something went wrong today.
I cloned my project from github, and then asked the AI agent to study the project and launch it. It was a regular project on react, but the cursor said that it had found some errors and continued to run the project. Suddenly, I find that he has cleared the project folder. At least that’s what I thought. Then I just cloned the repository again and manually launched the project. I tried to launch it. The node has been deleted. Then I went to the desktop. It was completely black. Not a single label. Just the shopping cart. I frantically tried to open explorer, but, “The application was not found. It may have been renamed, moved, or deleted.” All other programs in the taskbar are the same. At that time, only the running programs remained alive. I quickly stopped the cursor and went to restart the PC. After the restart, there is only one folder left on the disk. The document folder that contained this project.
Translated from Russian to English using Google Translate
Steps to Reproduce
I have never changed any cursor settings on a PC. I usually use a MacBook, and this behavior of an AI agent is simply unacceptable.
Translated from Russian to English using Google Translate
Operating System
Windows 10/11
Version Information
This was the latest version of the IDE for Windows 11. I can’t say for sure now.
After restarting the PC, the rest of the programs, including the cursor, that were open on the PC during the incident, were deleted. Right now my Windows looks like this xd
Hey, thanks for the report. This is really critical, and I can see the screenshots with an empty desktop.
This is a known issue on Windows. The agent can run destructive shell commands like rmdir /s /q and Remove-Item -Recurse -Force via the terminal, and File-Deletion Protection and External-File Protection don’t protect against that because they only apply to built-in file tools, not terminal commands. We’ve seen similar cases:
Also, since you’re on a Russian Windows locale, there’s a chance another bug was involved, related to UTF-8 encoding in PowerShell scripts. That could turn a command meant to delete a specific folder into deleting the drive root. This specific bug was fixed in later versions.
What to do now:
File recovery: as soon as possible, run Recuva or R-Studio. The key thing is don’t write anything new to that disk, so you don’t overwrite deleted data. The sooner you start, the better the chances.
After you recover the system and reinstall Cursor, make sure to turn off Auto-run mode: Cursor Settings > Agents > turn off “Auto-run mode”. The agent will ask for confirmation before every terminal command.
To help track the incident, if you can:
What exact Cursor version was it? Help > About
Was Auto-run mode enabled?
If you still have access to the Request ID from that chat, please send it (right top corner of the chat > Copy Request ID).
The team is aware of this issue. Let me know if you need help with anything else.
Thanks for the info. Good that the Program Files folder is still there and the chat is accessible. I passed this to the team. The Request ID will let us check the server side. I’ll let you know if there are any updates.
Find the file that matches the time of the incident. Let me know and I’ll DM you if you don’t want to post it publicly. It’ll show exactly which commands the agent ran, and that’ll help us understand what happened.
