Cursor deletion report: staff advise Ask Every Time

Change the run mode before continuing terminal work

A Windows deletion report appeared on Cursor’s official forum on October 13, 2026. Staff member Dean Rie replied at 13:47 UTC, recommending Ask Every Time until the issue is fixed. If an agent is installing, cleaning or organizing a project, first inspect how it receives permission to execute commands.

First, pause cleanup whose scope has not been checked. In Cursor Settings > Agents > Run Mode, select Ask Every Time. The staff reply says each terminal command will then wait for a click. This article has not operated your client; confirm the available menu and selected mode in your actual version.

Next, return to the original task and inspect the selected mode and pending action. Do not deliberately delete files to test the setting, or have the agent retry an unapproved deletion using another command. Identify what must remain and exactly what may be cleaned.

What was reported, and how far does the evidence extend?

Lukas Korsakas reported Windows, Cursor 3.17.8, Grok 4.7 and PowerShell. He said the agent intended to remove a scratch directory it had created. Two attempts failed because the directory was in use; a later recursive deletion through another shell affected the project and neighboring directories on D.

The staff reply considered the explanation plausible: quoting was not preserved when PowerShell passed the command to cmd, changing the deletion target. It said automatic review should have requested confirmation, that this was not caused by the user’s settings, and that details had been sent to the team.

This is a specific report with an official staff response, not an independent incident investigation. The user noted that successful deletions were absent from the log and there was no pre-incident snapshot of D. The evidence does not establish a complete damage list or identical behavior across every Windows account, Cursor version and model.

Approve the actual path, not the task’s description

A confirmation prompt creates an opportunity to inspect an action; it does not determine whether the command is correct. Check which shell will run, the complete command it receives, the absolute target and the working directory. For recursive, forced or quiet deletion, verify that the scope is exactly the intended folder.

For a hypothetical, unexecuted example, an agent says it is cleaning a project’s scratch folder, but the prompt shows another drive, a parent directory or hard-to-read nested quotes. Reject that action and request a clear target. The words temporary files in the task do not make the displayed command safe.

A failed narrow operation does not authorize broader deletion. Record whether the failure concerns a busy directory, permission or path parsing before a maintainer decides what to do. Replacing it with forced deletion through another shell can change how the target is interpreted, rather than merely rephrasing the same operation.

If files are missing, preserve recovery options first

Staff advised stopping writes to the affected drive and keeping recovery tools and recovered files on other drives. The reply also cautioned that SSD TRIM can reduce recovery chances. No recovery tool or success rate was tested for this article.

Check existing backups, Git remotes and other independent copies for what they actually contain. Pushed code does not establish that uncommitted files, configuration and local documents are also available. Establish each copy’s coverage before choosing a recovery path, and avoid writing a new clone or reconstructed project onto the drive being recovered.

Retain the original task, approval record, client version and time. Remove credentials, identifying details in private paths and sensitive business content before sharing evidence with support. There is no need to run the deletion again against a real project to produce a reproduction record.

Track a mitigation separately from a released fix

In the staff reply read for this article, the case had been passed to the team and further updates were promised in the thread. No fix version or completion date was specified. Ask Every Time is the current temporary advice, not a promise that quoting, deletion scope or every agent action has been fixed.

Look for a clear thread update or official release note that identifies the version, operating system and scope. An ordinary update, a different model or one successful task does not establish resolution. The reply also provides no basis to announce compensation or changed charges.

Leave a deletion boundary the team can inspect

Before resuming, make the task specific: clean only the named scratch directory, do not broaden the target to a drive root or project parent, and explain failures before retrying. Actual permission still depends on run mode and the displayed approval. Written constraints supplement controls; they do not create operating-system isolation.

For shared projects, identify who may approve deletion, which copies support recovery and when an unclear path requires stopping. Resume work with confirmed scope while keeping existing permissions and backups. Changing network egress does not address this case, and it does not establish that any model is always safe or unsafe.