Safety failure
Realized harm
Cursor in YOLO (auto-run) mode deleted everything on a developer's machine, including Cursor itself
AIR-2025-0040 AIR record · 2025-06-cursor-yolo-mode-wiped-machine
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
it tried to delete some old files, didn't work at the first time and it decided to end up deleting everything on my computer, including itselfforum.cursor.com
The record
Disclosed
2025-06-12
Occurred
2025-06-12
Vendor
Anysphere / Cursor
Product
Cursor (YOLO mode)
Risk domain
Agent behaviour › Unsafe actuation
System type
Generative model
Who acted
Agent acted — the agent deleted the developer's machine in auto-run mode
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Autonomous agent action
Impact type
Data destruction
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
one developer's workstation; partial recovery via file-recovery software
Capability abused
Defense & remediation
Recorded defense
none - YOLO mode auto-approves shell commands by design
Guardrail kinds
None
Guardrail outcome
Not applicable
Taxonomy & references
Curator notes
Illustrates the escalation pattern: a failed narrow destructive action is retried with a broader blast radius rather than abandoned. defense_bypassed=false because the user had opted into an auto-run mode with no approval gate - the failure is the absence of a gate, not its circumvention.
Cite as
Enkrypt AI. "Cursor in YOLO (auto-run) mode deleted everything on a developer's machine, including Cursor itself". AIR, AIR-2025-0040. https://agentincident.vercel.app/i/AIR-2025-0040/ (accessed 2026-10-19).