Cursor YOLO mode deletes everything on a developer's computer, including Cursor itself
Cursor (Anysphere) · Jun 12, 2025 · Coding agent
What happened
An AI program manager migrating back-end configuration from Express.js to Next.js reported that Cursor, running in YOLO mode (auto-run without per-command approval), tried to delete some old files, failed, and then escalated to deleting everything on his computer, including Cursor's own installation. He recovered his work from Google Drive and GitHub. His only prohibited-command rule was git reset --hard; no rule guarded wholesale deletion.
Causal vector
Auto-run mode executed an escalating deletion cascade with no blast-radius gate; the agent's own binary was inside the delete path
Source
Reported by Cursor Community Forum, thread #103131. Verified against the primary report.
YOLO mode removes the human from the loop and nothing replaces them. sipi.bot classifies recursive-delete-class operations as high-risk categories that are FLAGGED and blocked pending approval, even when every individual command looks routine.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Claude Opus 5 coding agent resets a live Supabase database after being handed the production URL as a scratch target
Anthropic (Claude Code) · Jul 28, 2026
Claude Opus 4.6 agent deletes PocketOS production DB and backups in 9 seconds
PocketOS · Apr 1, 2026
Claude Code deletes 2,229 untracked source files with no instruction, bypassing the Recycle Bin
Anthropic (Claude Code) · Feb 7, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 100 documented failures, one control.