How to use Cursor to evaluate background Git isolation

Or Hiltch evaluated Cursor CLI with a prepared project archive and a read-only request. The model was explicitly told not to run shell commands. Nevertheless, Cursor’s background Git indexing honored executable repository configuration and wrote a benign proof marker outside the workspace.

The researcher recorded process ancestry and Git arguments to distinguish the harness’s internal operations from model-generated shell execution. A direct shell attempt at the same host write was blocked by Seatbelt. Removing the repository hook produced no marker. Together, those controls localized the failure to background Git, rather than demonstrating that the sandbox was universally absent.

Cursor’s fix supplied hardening through environment-level Git configuration across child processes, disabling filesystem monitoring and other executable configuration paths. Hiltch repeated the original test three times in clean processes and reports that the hook no longer fired.

The published demonstration used a pre-armed archive. The researcher explicitly did not test the nested-repository delivery path through a normal clone for Cursor. That limit matters: the demonstrated result is a specific controlled harness escape and verified retest, not proof of every suggested delivery scenario. The human checkpoint was negative controls and process tracing before claiming a fix.

Prompt
Original prompt

Source: Accomplish blog · Or Hiltch