{
 "public_id": "AIR-2025-0025",
 "incident_id": "2025-04-cursor-support-agent-fabricated-policy",
 "date_disclosed": "2025-04-17",
 "date_occurred": "2025-04-16",
 "title": "Cursor's front-line AI support agent invented a one-device-per-subscription policy, triggering subscription cancellations",
 "class": "safety_failure",
 "attack_surface": "consumer_chatbot",
 "initial_vector": "model_hallucination",
 "agent_capability_abused": [
  "email_reply_on_behalf_of_vendor",
  "customer_facing_authority",
  "autonomous_customer_reply",
  "email_send",
  "autonomous_customer_communication",
  "policy_assertion"
 ],
 "target_product": "Cursor support (AI email agent, signed as 'Sam')",
 "target_vendor": "Anysphere / Cursor",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "reputational_damage",
  "financial_loss",
  "false_commitment",
  "business_loss",
  "reputational_harm",
  "misinformation",
  "customer_churn"
 ],
 "blast_radius": "Cursor customers who contacted support about multi-device logouts; several publicly cancelled subscriptions",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI03",
   "ASI09"
  ],
  "mitre_atlas": [],
  "labels": [
   "binding_false_commitment",
   "hallucinated_policy",
   "unlabeled_ai_agent",
   "non_deterministic_support",
   "hallucination_with_authority",
   "unlabelled_ai_agent",
   "support_automation",
   "unlabelled_ai_support",
   "agent_speaks_for_the_company"
  ]
 },
 "defense_present": "none - AI replies were sent to customers unlabelled and unreviewed",
 "defense_bypassed": true,
 "fix_shipped": "AI-generated support emails are now labelled as AI; underlying session race condition fixed; refund issued",
 "primary_sources": [
  "https://www.theregister.com/2025/04/18/cursor_ai_support_bot_lies/",
  "https://winbuzzer.com/2025/04/22/cursor-ais-support-bot-hallucinates-policy-sparking-user-backlash-and-company-apology-xcxwbn/",
  "https://fortune.com/article/customer-support-ai-cursor-went-rogue/",
  "https://incidentdatabase.ai/cite/1039",
  "https://www.theregister.com/special-features/2025/04/18/cursor-ai-support-bot-hallucinated-its-own-company-policy/1015579"
 ],
 "verified_quote": "We have no such policy. You're of course free to use Cursor on multiple machines.",
 "confidence": "high",
 "notes": "No adversary: the agent hallucinated a product policy in response to ordinary support tickets caused by a session-management race condition. Amplifying factor was non-determinism - some users were told about the 'policy' and others were not, so users comparing notes could not tell it was fabricated. Winbuzzer: users 'were informed by an AI bot - reportedly named Sam - that their subscription was limited to a single active session, a restriction the company later confirmed was entirely fictitious.' | Merged from duplicate id `2025-04-cursor-support-bot-fabricated-device-policy`. Also reported under the titles: 'Cursor's autonomous support agent 'Sam' invented a login policy, triggering subscription cancellations'; 'Cursor's front-line AI support agent invented a single-device login policy, triggering subscription cancellations'.",
 "risk_category": "brand_trust",
 "risk_secondary": [
  "security_fraud"
 ],
 "risk_subcategory": "Reputation Harm via Misinformation",
 "risk_sub_secondary": [],
 "risk_override_reason": "the agent invented a subscription policy and customers cancelled; hallucination is the mechanism, lost trust is the harm",
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the support agent autonomously emailed the invented policy to customers",
 "vector_family": "none_autonomous",
 "vector_detail": "model_hallucination",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [
   1039
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI03",
 "agent_framework": "cursor",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "human_manipulation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [
  "unsafe_actuation",
  "opaque_reasoning"
 ],
 "eai_reason": "subcategory: Reputation Harm via Misinformation",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI03 (signal=identity); ASI09 (eai_category=human_manipulation)",
 "submitted_by": "EAI Internal"
}