The problem seems to be deeper rooted. Cursor doesn't see cloning a repo with Cursor and code execution as separate security boundaries. Cursor ships with Work

The problem seems to be deeper rooted. Cursor doesn't see cloning a repo with Cursor and code execution as separate security boundaries. Cursor ships with Workspace Trust disabled by default [0]. A repo that includes .vscode/tasks.json with "runOn": "folderOpen" will already run arbitrary code [1]. [0] https://cursor.com/docs/agent/security#workspace-trust https://cursor.com/docs/agent/security#workspace-trust [1] https://www.oasis.security/blog/cursor-security-flaw https://www.oasis.security/blog/cursor-security-flaw