Cursor’s agent reads your code, edits files and runs terminal commands in a loop, in the editor and in the Cursor CLI, and cloud agents do the same on remote machines. Locally, it does all of that with your permissions.
Cursor’s default run mode sandboxes shell commands where it can and reviews the rest, but Workspace Trust is off by default and a repository’s .cursor/ folder adds to your configuration. This post covers what goes wrong, the incidents, their impact, and the controls that work.