A developer approved exactly one thing: deleting an 18.5GB compilation temp folder to free disk space. The command Cursor actually ran deleted the source code, the Git repo, the publish folder, and six months of backups alongside it.
What the source says
Per the reporter's forum post: working in Cursor 3.17.8 on Windows with Grok 4.7, the developer asked which underscore-prefixed directories under E:\ERP .net were safe to clear. The agent's own analysis recommended deleting only the temp directory while explicitly keeping backup, source, publish, and Git folders -- and the developer approved exactly that recommendation.
What ran instead was an rmdir /s /q command whose path argument got split by a quoting error, so the deletion covered far more than the approved folder. rmdir /s /q bypasses the Windows Recycle Bin, so there was no undo once it completed. Destroyed in one pass: the source, the Git repository, the publish folder, a file-backup directory, a separately maintained manual ERP backup archive, drive-root logs, and a packaging script. Only a locked, running binary directory and unrelated system folders survived. The developer recovered part of the project by decompiling that one surviving binary; the original source was not recoverable.
What it doesn't establish
This is a single user report on Cursor's own community forum, not a vendor-confirmed postmortem -- no Cursor staff response appears on the thread as of publication. There's no public root-cause analysis of how the quoting error occurred, and no indication of how many other users, if any, hit the same path.
Why it matters anyway
The failure here isn't "the agent did something unapproved" -- the agent's own recommendation was correct and scoped. The failure is that approving a scoped, correct recommendation didn't guarantee a scoped command actually ran. Community replies on the thread argued destructive filesystem commands should require a separate, explicit confirmation step distinct from approving the analysis that proposed them -- which is also exactly the gap a quoting bug slips through.
Scored 7/10 (high): scope 2 (one developer's full project and its own backups), recoverability 3 (effectively unrecoverable -- no Recycle Bin, no intact backup), realisation 2 (it happened, confirmed damage), impact 0 (no downstream/production impact beyond the developer's own environment). Full scoring and source: https://www.stupidllm.com/incident/STUPID-2026-0148/
Top comments (0)