Working habits
Settings can’t cover everything, so these habits cover the rest:
- Read untrusted content first: instruction-like text in an issue, pull request, message or MCP result is the attack.
- Treat changes to
.cursor/, rules files and.git/as security events, whether you or the agent made them. - Keep production credentials out of your environment: an agent can’t misuse a token it can’t see.
- Don’t give the agent a Docker socket on macOS until the privileged-container escape is fixed.
- Put project rules in
.cursor/rules/: they shape the code Cursor writes, but only the sandbox, run mode and allowlists enforce anything.