Cursor 3.24 asks for confirmation before dangerous deletions, but Run Everything stays silent

The most unpleasant agent failure is not broken code, but a command that silently deletes the wrong thing. One ill-fated rm -rf, one wildcard that expands more broadly than expected, and half the project is already gone. Recent Cursor versions have mitigated some of this risk, but only if you have not disabled the protection yourself.

What changed in 3.24

According to Cursor's release notes, starting with version 3.24, Auto-review mode asks for permission before risky deletions. Four cases fall into this category: recursive deletion, forced deletion, wildcard deletion, and situations where the actual target may differ from the one specified in the command.

The last case is the most insidious. Suppose the agent is about to clean the build directory, but the path is constructed from a variable that is empty or points one level higher. The command looks harmless but may delete something entirely different. Cursor now stops at that point and waits for your confirmation.

Where there is no protection

Run Everything mode works differently. According to Cursor's documentation, the agent executes every command in sequence, with neither a sandbox nor a risk classifier. Restrictions apply only if you define them yourself in permissions.json.

In effect, it is a single switch. While it is enabled, the “are you sure?” prompt will not appear at all, even for a command that wipes out a directory. That may be convenient for quick experiments in a disposable repository. For a working project without a backup, it is a bet that the agent will not make a mistake.

If speed is still essential, it is more sensible to define boundaries in permissions.json—specifying what the agent may and may not run—rather than disabling protection entirely. This way, the no-questions-asked mode at least does not extend to dangerous operations.

A simple habit: commit before making changes

The post's author recommends two things. First, keep Auto-review as the default mode. Second, make a commit before asking the agent to perform a major change.

The second point matters because of how Cursor checkpoints work. They are stored locally and separately from git. Their purpose is to roll back an agent's changes, not to maintain the project's history. Only git retains permanent history. A checkpoint therefore cannot be treated as a substitute for a commit: if the directory itself or the working environment is damaged, the only reliable recovery point will be in the repository.

In practice, the workflow looks like this:

• before assigning a major task to the agent, capture the current state in a commit;
• keep Auto-review enabled, especially in projects containing important data;
• if you use Run Everything, narrow its permissions in permissions.json;
• treat checkpoint rollback as a convenience, not as insurance.

Limitations and context

To be clear, this is not a study or a benchmark, but a brief note based on release notes and documentation. The post does not explain exactly how Cursor defines a “risky” deletion or how reliably it catches every variation. Auto-review should therefore not be trusted completely either: it reduces risk but does not eliminate the need for disciplined commits.

The post is partly promotional: it continues the animated series “Vibe Coder and Bug,” whose fifth episode covers this topic, and invites readers to join the NeyroMakers club. The author separately discloses the episode's cost: about $5 at API prices, equal to 0.5% of the subscription's weekly limit, plus around 9 cents for ElevenLabs voice-over. Claude wrote the script and animation in Claude Code.

Conclusion

If you work with agents in Cursor, take a minute to check which mode they are running in. If it is Run Everything and permissions.json contains no restrictions, you have effectively authorized the agent to do anything. Switch back to Auto-review and make a habit of committing before major tasks. It costs almost nothing and protects against the most unpleasant category of failures.