Why does Cursor stil try to phone home to Microsoft servers?

Support Bug Reports
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Just downloaded v1.5.11 (forked from VSCode Version: 1.99.3). My firewall reported outgoing connections to default.exp-tas.com. Googling that domain shows this is a Microsoft server that VSCode stopped using since v1.65.2.

Why is Cursor still trying to connect to it? This was the first day of use, so it wasn’t supposed to phone home with any of my data, even before disabling that in Settings.

Steps to Reproduce

  1. Install a firewall that intercepts outgoing connections
  2. Download the latest Cursor appImage
  3. Run it

Expected Behavior

No connections to shady domains like exp-tas.com.

Operating System

Linux

Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.5.11
VSCode Version: 1.99.3
Commit: 2f2737de9aa376933d975ae30290447c910fdf40
Date: 2025-09-05T03:48:32.332Z
Electron: 34.5.8
Chromium: 132.0.6834.210
Node.js: 20.19.1
V8: 13.2.152.41-electron.0
OS: Linux x64 6.14.0-28-generic

Does this stop you from using Cursor

No - Cursor works, but with this issue

2

Hey, thanks for the report, I’ll pass this on to the team.

3

Thanks @deanrie . Here’s a screenshot and details.

image
image720×228 51.6 KB

TCP 57294:192.168.55.103 -> 13.107.5.93:443 

Path:      /tmp/.mount_CursorsAgUgc/usr/share/cursor/cursor
Cmdline: /tmp/.mount_CursorsAgUgc/usr/share/cursor/cursor --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --no-sandbox --dns-result-order=ipv4first --inspect-port=0 --crashpad-handler-pid=2618190 --enable-crash-reporter=b5ae586a-a6cc-4338-ad46-0089cd2b0902,no_channel --user-data-dir=/home/andrew/.config/Cursor --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,17275636747645102497,17085591435321245368,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess --variations-seed-version
4

Another domain Cursor tries to connect to: mobile.events.data.microsoft.com. How does “mobile” make any sense?

image
image715×220 51.7 KB