How Cursor Wiped a Subscriber's PC

A subscriber shared a story. The situation is quite banal: a person asked Cursor to delete duplicate articles in a dissertation, and it generated a command with a quote escaping error. The model used a backslash, forgetting that in Windows, \ is a path separator, not an escape character. This backslash detached from the path and turned into an instruction to delete the root of drive C, and rmdir /s /q began to wipe everything, including system folders. There were no backups, but since the files were not overwritten upon deletion, most were able to be restored, though there was still a lingering feeling of loss. The moral is quite simple – do not run agents with full access where they can cause irreparable harm. Anything will do – Docker, Mac Mini, some Raspberry Pi, a virtual machine in the cloud, as long as it’s not on the main machine. Some might even say that it’s not worth sitting on Windows (at least not without WSL). And backups should be kept in places inaccessible to agents.