The problem
What Cursor can reach
In Auto-review, the default run mode, shell commands run in a sandbox that allows the workspace and limits the network, and anything that can’t use it goes to a classifier (Cursor docs). Allowlisted commands run outside the sandbox, and the sandbox leaves ~/.ssh readable.
What Cursor loads matters as much as what it runs. Your ~/.cursor files, a project’s .cursor/ folder, rules files, AGENTS.md, MCP servers and hooks all instruct or execute, and every web page, issue and MCP result can carry instructions aimed at the model.