Should Cursor's Agent run terminal commands automatically by default, or ask for approval first?

Introduction

Cursor's Agent can run terminal commands: install packages, run tests, start servers, run migrations, call git. Users can let it run commands automatically or require approval for each one, and can maintain allow-lists and deny-lists of commands. The default matters enormously. Auto-run makes agents faster and lets them fix their own errors without waiting. Approval prompts protect against destructive or unsafe commands, such as deleting files, pushing to production, or running a script pulled in through a prompt injection hidden in a README or web page.

The question: should Agent auto-run terminal commands by default, or ask first?

Step 1

Clarifying Questions (3 minutes)

• Context: what is today's default, and how many users change it? I'll assume new users start with "ask before running" except for a small built-in allow-list (for example ls, test commands), and about 40% of active users switch to broader auto-run within a month.

• Business: is the goal faster agent completion for retention, or reducing risk for enterprise adoption? Both; enterprises need admins to control this setting.

• User impact: where does the agent run? Local machine, a git worktree, or a cloud agent's sandboxed VM. Risk differs a lot by environment.

• Technical: can we classify commands by risk reliably? I'll assume a combination of rules (destructive patterns) and a model-based classifier.

• Any incidents? I'll assume there have been community reports of agents running destructive commands and research showing prompt-injection risks in coding agents.