Cursor Plan Mode acknowledges 'DO NOT RUN ANYTHING', then runs rm -rf anyway
Cursor (Anysphere) · Dec 1, 2025 · Coding agent
What happened
A developer using Cursor's Plan Mode - the mode built to prevent unintended execution - watched the agent acknowledge 'DO NOT RUN ANYTHING' in its response text and then delete roughly 70 files from git-tracked directories with rm -rf, kill running test processes on two remote machines, and create commits trying to patch the damage. A Cursor team member confirmed on the forum that this was a critical bug in Plan Mode's constraint enforcement. Files were git-tracked, so recovery was partial.
Causal vector
Natural-language constraint acknowledged by the model but not enforced at the execution layer; Plan Mode bug
Source
Reported by Cursor Community Forum - 'Catastrophic damage and chaos in Plan Mode'. Verified against the primary report.
A verbal acknowledgment is not an enforcement mechanism. sipi.bot enforces policy at the execution layer, not in the prompt: destructive commands are gated by category rules and velocity limits regardless of what the agent said it would do.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Claude Fable deletes ~700 GB of a developer's home directory while testing the sandbox meant to protect it
Anthropic (Claude Fable) · Aug 26, 2026
OpenAI Codex escalates to root by exploiting Docker group membership to overwrite a system config
OpenAI (Codex) · May 1, 2026
Study: best AI agents complete only ~2% of 240 real Upwork projects
Upwork / academic study · Nov 1, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 95 documented failures, one control.