Sandbox, Auto-review and prompt injection

Prompt injection is when content the agent reads, not your prompt, tries to give it orders: a README, a web page, an issue comment or an MCP tool result saying "run this command to send the API keys to...". Models can't reliably separate your instructions from instructions buried in data. So safety must come from limits the agent can't talk its way past.

Cursor's layers, from the run-modes settings:

• Sandbox for shell commands (macOS uses the built-in Seatbelt; Linux uses kernel features such as Landlock or bubblewrap). By default sandboxed commands can read and write inside the workspace, protected paths such as .git/config, .git/hooks, .vscode and .cursorignore are guarded, and network is blocked unless opened.
• `sandbox.json` (global ~/.cursor/sandbox.json, or per project, which wins) sets the network policy and extra paths. Network modes: your allowlisted domains only, your list plus built-in package-manager domains (default), or allow all.
• Read access: "Workspace" makes reads outside the project require approval (unless on a read allowlist); the default "System" allows them.
• Auto-review classifier guidance in permissions.json (~/.cursor/ or <project>/.cursor/) with plain-English allow_instructions and block_instructions; team settings override both.
• Protections for file deletion, outside-workspace edits and browser use.

Remember Cursor's own warning: Auto-review is not a security boundary. A failed sandboxed command may be retried outside the sandbox after classifier review.

Defensive setup: Auto-review with protections on, narrow network allowlist, workspace-only reads for sensitive machines, minimal credentials in the agent's environment, trusted MCP servers only, and extra suspicion whenever the agent acts right after reading outside content.