Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Safety failure Realized harm

Cursor's front-line AI support agent invented a one-device-per-subscription policy, triggering subscription cancellations

AIR-2025-0025 AIR record · 2025-04-cursor-support-agent-fabricated-policy
Open in dashboard About
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
We have no such policy. You're of course free to use Cursor on multiple machines.theregister.com
The record
Disclosed
2025-04-17
Occurred
2025-04-16
Vendor
Anysphere / Cursor
Product
Cursor support (AI email agent, signed as 'Sam')
Risk domain
Agent behaviour › Human manipulation
Also touches
Unsafe actuation, Opaque reasoning
System type
Generative model
Who acted
Agent acted — the support agent autonomously emailed the invented policy to customers
Attack surface
Consumer assistant
Autonomy level
Semi-autonomous
Initial vector
Model hallucination
Impact type
Reputational damage, Financial loss, False commitment, Business loss, Reputational harm, Misinformation, Customer churn
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI09 – Human-Agent Trust Exploitation
MITRE ATLAS
AML.T0054 – LLM Jailbreak
NIST AI RMF
MAP 5.1
EU AI Act
Recital 45
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
C. Safety
Scope
agent misuse
Mitigation
Communicate model limitations; Require human oversight; Watermark AI content; Design for explicit consent.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Cursor customers who contacted support about multi-device logouts; several publicly cancelled subscriptions
Capability abused
email_reply_on_behalf_of_vendorcustomer_facing_authorityautonomous_customer_replyemail_sendautonomous_customer_communicationpolicy_assertion
Defense & remediation
Recorded defense
none - AI replies were sent to customers unlabelled and unreviewed
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
AI-generated support emails are now labelled as AI; underlying session race condition fixed; refund issued
Taxonomy & references
OWASP ASI03 Identity and Privilege AbuseOWASP ASI09 Human-Agent Trust Exploitationbinding_false_commitmenthallucinated_policyunlabeled_ai_agentnon_deterministic_supporthallucination_with_authorityunlabelled_ai_agentsupport_automationunlabelled_ai_supportagent_speaks_for_the_company
Curator notes
No adversary: the agent hallucinated a product policy in response to ordinary support tickets caused by a session-management race condition. Amplifying factor was non-determinism - some users were told about the 'policy' and others were not, so users comparing notes could not tell it was fabricated. Winbuzzer: users 'were informed by an AI bot - reportedly named Sam - that their subscription was limited to a single active session, a restriction the company later confirmed was entirely fictitious.' | Merged from duplicate id `2025-04-cursor-support-bot-fabricated-device-policy`. Also reported under the titles: 'Cursor's autonomous support agent 'Sam' invented a login policy, triggering subscription cancellations'; 'Cursor's front-line AI support agent invented a single-device login policy, triggering subscription cancellations'.
Supporting sources
Cite as
Enkrypt AI. "Cursor's front-line AI support agent invented a one-device-per-subscription policy, triggering subscription cancellations". AIR, AIR-2025-0025. https://agentincident.vercel.app/i/AIR-2025-0025/ (accessed 2026-10-19).