Keep the sandbox on, and update: most escapes were fixed in releases, and Run Everything removes the sandbox entirely.
Treat what Cursor loads as code:.cursor/, rules files, MCP entries, hooks and .git/ all run or instruct, so review them like a pull request before trusting a folder.
Keep allowlists short: allowlisted commands run outside the sandbox without asking, and Cursor says allowlists “are not a security guarantee”.