Stop Cursor's agent from running drive-wide deletes

If you let Cursor's agent run commands on Windows, set up a hook that blocks recursive and forced deletes before they reach your shell. One user reports that on Saturday an agent in Run Everything mode deleted almost an entire 1 TB drive with one badly quoted command. Cursor staff say the issue is tracked and posted the setup that would have stopped it.

• Status: one user's report, confirmed as a tracked issue by staff. No fix date.
• Affects: Cursor agent users on Windows, most of all in Run Everything mode. Staff's advice applies to any run mode.
• What to do now: switch to Allowlist, turn on the two protection settings, and add the hook below.

What happened#

At 9:57 AM ET Saturday, Newts00579 reported that an agent on Cursor 3.24.18, Windows 10 and Grok 4.7 High Fast tried to delete one subfolder with cmd /c "rmdir /s /q \"D:\<workspace>\<subfolder>\"". "PowerShell does not treat " as an escape, so the quoting broke," they wrote, and cmd.exe "effectively ran "rmdir /s /q ", which deletes the root of the current drive." The result: "Almost the entire D: drive (1 TB NVMe SSD) was deleted," and with TRIM on, "nearly all of the deleted data is unrecoverable." They also say the agent reported success after a timeout without checking.

At 11:41 AM ET deanrie replied: "This is an issue we're tracking." The user then confirmed the session used Run Everything. deanrie noted that in that mode "all tool calls run automatically, with no approval, sandbox, or classifier."

Why it matters#

The Run Modes docs describe Run Everything as "Every tool call runs automatically," for when "You accept the risk and want zero prompts." Our read: the command text looked like a delete inside the workspace, so even a person skimming it could miss the broken quoting. A hook checks the text the same way every time.

How to protect yourself#

Staff's steps, from post 6 and post 8:

1. In Cursor Settings > Agents > Approvals & Execution, switch Run Mode to Allowlist. Keep the list short, "with only specific safe commands like npm test. No cmd, powershell, or pwsh."
2. In the same section, "turn on File-Deletion Protection and External-File Protection as an extra layer." deanrie warns not to rely on them "for rmdir /s or rd /s through cmd /c."
3. Add a user-level beforeShellExecution hook in ~/.cursor/hooks.json that returns exit code 2 when it sees rmdir /s, rd /s, del /s, Remove-Item -Recurse or format. "That gives you a deterministic stop no matter how the model phrases the command."
4. Test it with cmd /c "echo rmdir /s /q test". "The agent should get blocked, not execute it."
5. Keep backups on a separate drive or in the cloud, where the agent can't reach them.

Example hook (ours). Save as ~/.cursor/hooks/block_deletes.py:

import json, re, sys
cmd = json.load(sys.stdin).get("command", "")
risky = re.compile(r"\b(rmdir|rd)\s+/s\b|\bdel\s+(/\w\s+)*/s\b|Remove-Item\b.*-Recurse|\bformat\s+[a-z]:|\brm\s+-[a-z]*r[a-z]*f?\b", re.I)
if risky.search(cmd):
    print(json.dumps({"permission": "deny", "user_message": "Blocked a recursive or forced delete. Run it yourself if you meant it."}))
    sys.exit(2)
print(json.dumps({"permission": "allow"}))

Then add it to ~/.cursor/hooks.json (our example too), using the full path to the script on Windows:

{
  "version": 1,
  "hooks": {
    "beforeShellExecution": [
      { "command": "python C:/Users/YOU/.cursor/hooks/block_deletes.py", "failClosed": true }
    ]
  }
}

We tested our script on Linux only, feeding it 9 sample commands as JSON input: it blocked the reported command, deanrie's echo test, rd /S, del /q /s, Remove-Item -Recurse, rm -rf and format d:, and let npm test and git status through. We did not test it inside Cursor on Windows.

Prompt (ours), as a rule for the agent:

Before you run any command that deletes files, show me the exact command and the full path it will touch, and wait for my yes. Never delete anything outside this workspace, and never wrap a delete in cmd /c.

Good to know#

• Hooks fail open by default. The hooks docs say other exit codes mean "Hook failed, action proceeds." Setting failClosed to true makes "hook failures (crash, timeout, non-zero exit code, no output) block the action instead."
• The allowlist isn't a wall. deanrie: "the allowlist is best-effort, not a security boundary."
• User-level hooks don't reach cloud agents. The docs say hooks in ~/.cursor/hooks.json "are not available in cloud agents."
• Staff passed along the user's requests, including "confirmation for recursive or forced delete, a sandbox on Windows, blocking drive roots and paths outside the workspace."

What to watch#

Whether Cursor adds the final check deanrie forwarded: "even in Run Everything, there should be a final check for recursive or forced deletion, and for targets at the disk root." deanrie said there's "no timeline yet." Watch the thread.