In settings Execution and Approvals, I have set the “Run Mode” to “Allowlist” and left the allowlist empty (none automatically allowed).
I continue to find the agent spinning up background terminals and running cli calls.
I first noticed it in the past two weeks; prior to that I always manually approved all cli calls. Unfortunately that is no longer true or reproducible.
Steps to Reproduce
This is not something I can manually reproduce as the agent decides when to perform these calls.
Expected Behavior
I expect that any evocation of command line requires explicit approval when the allowlist is empty.
Hey @cfix, thanks for the report. Quick fix to try: in Settings → Agents → Approvals & Execution, make sure Run Mode is plain Allowlist, not Allowlist (with Sandbox). The Sandbox variant auto-runs supported commands (including background terminals) without asking, even with an empty allowlist; plain Allowlist prompts for every command. I confirmed that on the current version. (Run Modes)
If you’re already on plain Allowlist (sandbox off) with empty allowlists and it still runs without asking, that shouldn’t happen and I’ll dig in. Could you share the exact Run Mode label you see, and reproduce once with data sharing temporarily on so I get a fresh request ID? (Privacy mode currently hides the actual command from us.)
we need a version where the allowlist also applies to the sandbox. just because cursor team THINKS they’ve effectively sandboxed commands does not mean the agent should run whatever they want in that sandbox. I want the sandbox for extra protection. the allow list still should apply to what’s allowed to run in the sandbox as well
Empty allowlist plus background terminals is the tell. Confirm the exact Run Mode label: “Allowlist (with Sandbox)” auto-runs supported shell, including background, with no prompt, even with an empty list. Plain Allowlist is supposed to gate every command. There is no user-side combo today where sandbox is extra protection and the allowlist still applies inside it. If the label already says plain Allowlist and terminals still start, turn data sharing on for one repro and paste the command that ran against those two request IDs so staff can see whether a background-terminal path skipped the matcher.
Good morning @mohitjain , I can’t go back for you to 3.17 to reproduce any scenario that enables agents to run arbitrary commands on my machine. That is a security risk I am not willing to take to help you troubleshoot.
FWIW at no point have I desired auto-run commands. I do not use any background auto-agentic mode and I review every cli request. If there was an option presented to me “Sandbox” it would have been deactivated. I never entered any values into the allowlist.
This happens occasionally on 3.10 (which was closer to the version I had been using through June). An image is attached showing how the agent decided to allowlist a command (shown with a checkmark on the UI with no way to deactivate the checkmark).
From my observations in 3.10, it only automatically allowlists previously approved commands; whereas in 3.17 it automatically ran arbitrary expressions.
