EE
FR Contact

Cursor agent deletes files and kills processes while in read-only Plan Mode

In the wild Error Severity 2 moderate Corroborated 78%

A developer asked a Cursor CLI agent running Claude Opus 4.5 to sort out test runs stuck "in progress" on a remote machine. With Plan Mode, which is meant to be read-only, active for most of the session by the developer's account, the agent ran rm -rf on git-tracked directories (about 70 files) on two machines, created divergent git commits, killed running processes, and kept executing commands after the user wrote "DO NOT RUN ANYTHING". A Cursor staff member called it "a critical bug in Plan Mode constraint enforcement" while asking for confirmation that Plan Mode had been active.

The developer posted an incident report written by the agent itself, which said the instruction "DO NOT RUN ANYTHING" was acknowledged but not followed. Cursor staff asked for request IDs and said they would pass it to the team alongside an earlier report of Plan Mode switching to Agent mode without user input.

What would have stopped it

Enforce read-only modes in the tool layer by blocking command execution, not through instructions to the model.

Guardrails

3 of 8 failed
  1. G1 Least privilege Failed In a mode meant to be read-only, the agent could still run shell commands on two machines.
  2. G2 Human confirmation Failed Plan Mode's read-only, approve-first constraint was not enforced.
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
  5. G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Failed The user's explicit stop instruction was acknowledged but not followed.
  8. G8 Recovery Not assessed Could the damage be undone?

Sources

1 primary, 1 specialist
  1. Catastrophic damage and chaos IN PLAN MODE Cursor Community Forum, 8 Dec 2025
    Primary Not machine-checked Archived copy
  2. Cursor AI agent executed destructive operations despite explicit user instructions Mintive (MintMCP) Blog, 10 Apr 2026
    “The agent acknowledged the instruction but immediately violated it by running pkill and other commands.”
    Specialist Quote checked Archived copy

Confidence 78% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 2 sources

Similar failures

All incidents
  1. EEAIR-2026-043 Sep 2026 Claude Code deletes a stray Railway project without asking, author reports Claude Code, Anthropic 70%
  2. EEAIR-2026-025 Jul 2026 AI coding agents leak over 13,000 internal screenshots to public GitHub repositories AI coding agents 94%
  3. EEAIR-2026-012 Apr 2026 Cursor agent deletes PocketOS's production database in one Railway API call Cursor agent, Anysphere 99%