kosa8

kosa8 / Guides

Guide · Cursor agent auto-run

How do I use Cursor's YOLO mode without risking my machine?

Updated

Keep Cursor's agent in Auto-review or Allowlist mode with its sandbox on, commit before each task, and use Run Everything, or --yolo in the Cursor CLI, only where the agent cannot reach anything you would miss. Cursor's command denylist was shown in 2025 to be easy to bypass, so a list of forbidden commands is not a boundary; a separate machine is. For the Cursor CLI that machine can be a microVM that sees one project folder, with checkpoints you can rewind.

01Steps

  1. Pick a run mode that keeps the sandbox. In the editor, open Settings, then Agents, then Approvals & Execution. Auto-review is Cursor's recommended default: allowlisted calls run at once, other shell commands run in the sandbox when possible, and the rest go to a classifier. Run Everything runs every tool call with no sandbox.
  2. Commit before every agent task. A clean commit is the point you can return to if the agent deletes or rewrites files in the project.
  3. In the Cursor CLI, keep the sandbox and skip --force. --force, also spelled --yolo, allows commands unless they are explicitly denied. Leave it off on your own machine and keep the sandbox enabled.
  4. For hands-off runs, install kosa8. kosa8 runs each agent in a microVM with its own kernel, on an Apple silicon Mac or an x86-64 Linux machine with KVM.
  5. Make the cursor kit your own. kosa8's built-in cursor kit is marked UNAVAILABLE: the npm package it used to install is not published by Cursor, and Cursor's own install script cannot be pinned to a digest. Copy the kit and point it at a source you have checked, for example an image that already contains Cursor's CLI, with command set to the binary that image provides.
  6. Run it in a sandbox you keep, with a name. --keep keeps the VM after the agent exits and --name gives it a name you can checkpoint. Arguments after the kit name go to Cursor's CLI, so this is where --force belongs if you use it.
  7. Checkpoint before the risky step, and rewind if it goes wrong. A checkpoint saves the VM's disk, memory and running processes. A rewind brings the same machine back, under the same name, in about a second.

02What is Cursor YOLO mode, and what does it turn off?

YOLO mode is the common name for running Cursor's agent without approval prompts: Run Everything in the editor, where every tool call runs automatically and outside the sandbox, and the --force flag (alias --yolo) in the Cursor CLI, which allows commands unless they are explicitly denied. Cursor's documentation describes Run Everything as the mode for when you accept the risk and want zero prompts.

03Can Cursor's auto-run denylist be bypassed?

Yes. In July 2025 Backslash Security reported at least four ways for a compromised agent to get past Cursor's denylist: encoding a command in Base64, running it in a subshell, writing it into a script and running that, and quoting tricks in bash. The Register reported that Cursor planned to deprecate the denylist. A list of forbidden command strings cannot cover every way of spelling a command.

The same limit applies to any filter that reads command text: the agent can always write a new program that does the same thing. A boundary that decides what the process can reach holds however the command is spelled.

04Does Cursor's sandbox protect my machine?

For shell commands, partly. On macOS Cursor runs them under Seatbelt through sandbox-exec, and on Linux under Landlock and seccomp, which needs kernel 6.2 or later with unprivileged user namespaces; network access is blocked by default and then opened by your sandbox.json and network mode. Run Everything does not use it, and Cursor says Auto-review is not a security boundary.

Ignore files are not a boundary either: Cursor's documentation says the terminal and MCP tools used by Agent cannot block access to files listed in .cursorignore.

05What can a checkpoint undo after Cursor's agent deleted files?

Everything inside the sandbox's own machine: its disk, memory and running processes. The project folder shared from your computer is your real folder, and a rewind does not roll its contents back, so commit before each task and use git for that folder.

  • Ten checkpoints per sandbox. The oldest is dropped past that, and rewinding to an earlier one drops those taken after it.
  • A rewind cannot itself be undone. Take a checkpoint first if you might want the current state back.
  • The key is passed in. The cursor kit copies CURSOR_API_KEY into the sandbox, where the agent can read it, and says so on every run. Use a key you can revoke.
  • Not separately documented. kosa8 does not document a tested Cursor integration beyond the kit above; treat it as running any CLI agent in a sealed VM.

06Other options

  • Cursor's Auto-review or Allowlist mode with the sandbox on fits most work in the editor, together with git.
  • A dev container fits teams that already use one; Cursor can connect to a container that follows the Dev Containers spec.
  • Docker Sandboxes runs agents in microVMs from Docker's tooling.
  • A full VM in UTM or Lima fits when you want to run the whole editor in a guest you manage yourself.
  • Hosted sandboxes such as E2B, Daytona or Modal fit agents that should run in the cloud.

07Sources

  1. Cursor docs: run modes and sandbox
  2. Cursor docs: CLI parameters (--force, --yolo, --sandbox)
  3. Cursor docs: ignore files
  4. The Register: Cursor AI YOLO mode lets coding assistant run wild (2025-07-21)
  5. kosa8 docs: Writing a kit (the cursor kit)
  6. kosa8 docs: Save and undo
  7. kosa8 docs: Run an AI assistant