STUPID-2026-0162

Cursor silently ran git stash and git reset HEAD mid-agent-session, dropping 45 files of uncommitted work

4.0medium
March 28, 2026Source checked

Why 4/10

One working tree, one developer, one session: 45 files (641 insertions, 183 deletions) were stashed and the branch reset to HEAD with no prompt and no "Overwrite uncommitted changes?" dialog. The change was recovered from the dangling commit before garbage collection, so nothing was permanently lost, but only because the reporter caught it in time. Cursor staff confirmed it is unexpected behavior and an open bug class, not a one-off; they did not confirm a root cause or ship a fix.

Scope
1/4
A few files, one session, one credential, or a small cost
Recoverability
1/3
Fully recovered, with effort
Did it happen
2/2
Happened in real use
Beyond the user
0/1
Only the user's own non-production work

The score is the sum of these four factors. How each factor is scored · scored 2026-11-11

Guardrail rules for this command

Destructive git: make your agent stop and ask before running these. Free to copy; written in each tool’s documented format.

Claude Code
{
  "permissions": {
    "ask": [
      "Bash(git reset --hard*)",
      "Bash(git clean *)",
      "Bash(git push --force*)",
      "Bash(git push -f*)",
      "Bash(git stash drop*)",
      "Bash(git filter-repo*)",
      "Bash(git worktree remove *)"
    ]
  }
}
Add to .claude/settings.json in the project (or ~/.claude/settings.json for every project). Each matching command then asks you first, including in auto mode.

Stronger control: Turn on the sandbox (/sandbox): shell commands can then write only to the project, a temp folder and directories you add. It runs on macOS, Linux and WSL2; on native Windows Claude Code runs commands unsandboxed. Docs

Codex
prefix_rule(pattern = ["git", "reset", "--hard"], decision = "prompt")
prefix_rule(pattern = ["git", "clean"], decision = "prompt")
prefix_rule(pattern = ["git", "push", ["--force", "-f"]], decision = "prompt")
prefix_rule(pattern = ["git", "stash", "drop"], decision = "prompt")
prefix_rule(pattern = ["git", "filter-repo"], decision = "prompt")
prefix_rule(pattern = ["git", "worktree", "remove"], decision = "prompt")
Save as ~/.codex/rules/stupidllm.rules and restart Codex. Codex's docs describe rules as controlling commands run outside its sandbox, and mark them experimental.

Stronger control: Keep Codex's OS sandbox on (it limits writes, typically to the workspace) and leave approvals on for sessions that can reach data you cannot lose. Docs

Gemini CLI
[[rule]]
toolName = "run_shell_command"
commandPrefix = ["git reset --hard", "git clean", "git push --force", "git push -f", "git stash drop", "git filter-repo", "git worktree remove"]
decision = "ask_user"
priority = 100
denyMessage = "Destructive command: needs a human to confirm (stupidllm.com)"
Save as ~/.gemini/policies/stupidllm.toml. Workspace-level policy files are disabled in Gemini CLI, so this must be the user-level folder.

Stronger control: Policies in ~/.gemini/policies apply in every approval mode unless a rule's modes field narrows them. Docs

Copilot CLI
copilot --deny-tool='shell(git reset)' --deny-tool='shell(git clean)' --deny-tool='shell(git stash)' --deny-tool='shell(git filter-repo)' --deny-tool='shell(git worktree)'
Pass on the command line. Copilot CLI matches the program name (and git/gh subcommands), so this blocks the whole command, not just its dangerous form.

Stronger control: Avoid --allow-all-tools on a machine with data you cannot lose; --deny-tool takes precedence over it. Docs

Cursor · Cursor documents a command allowlist and a sandbox for terminal commands, but no deny list, and calls these best-effort guardrails rather than a hard security boundary. Use the sandboxed Run Mode. Docs

What these cannot do: a pattern rule matches the command text the agent writes. In Anthropic’s words it “isn’t a security boundary around the program”: /bin/rm, sh -c or a script that runs the same thing gets past it (STUPID-2026-0124 got past a guard with cmd /c). Use the sandbox as well, and keep backups of what you cannot lose.

  1. Instruction given

    Investigate a bug (a training plot not appearing) during a long agent session, after a preceding refactor across 25+ files

  2. Expected behavior

    Never run git stash or git reset against the user's working tree without an explicit prompt or confirmation dialog

  3. Actual behavior

    During a ~2.5 hour, 30+ generation agent session on Linux, Cursor ran git stash followed by git reset HEAD on its own, with no user action, no checkpoint-related prompt, and no entry in the Git extension log. The agent then kept working on the now-clean tree without noticing anything had changed.

  4. Damage

    45 modified files (641 insertions, 183 deletions) of uncommitted work were stashed and the branch reset to HEAD without consent. The stash was auto-dropped before the reporter noticed, but the underlying commit object was still in the Git object store and was recovered manually before garbage collection could remove it.

Full write-up

A developer reported that Cursor (2.6.21, on Linux) silently executed git stash immediately followed by git reset HEAD partway through a long, otherwise unremarkable agent session — investigating a bug after a prior 25+-file refactor — with no user-initiated git action, no "Overwrite uncommitted changes?" dialog, and no matching entry in the Git extension's own log. The reflog showed the stash created one second before a reset: moving to HEAD event. 45 files (641 insertions, 183 deletions) of uncommitted work vanished from the working tree; the agent carried on operating against the now-clean tree without flagging anything unusual.

The reporter recovered the work from the dangling stash commit before Git's garbage collector could reclaim it, but only because they caught the reflog entry in time. In a reply, Cursor staff member Mohit called it "not expected checkpoint behavior," confirmed "an internal workspace operation ran destructive git commands without prompting," and said it was "a known issue class that our team is actively investigating" — while stopping short of confirming what triggered it. The reporter separately ruled out context-summarization as the cause in a controlled test. As of the thread's last update, no root cause or fix had been confirmed, and Cursor's own checkpoint system — intended as a safety net, not a vector for data loss — was the thing that erased the work.

Classification

Agent
Cursor
Failure mode
Destructive Action
Root cause
Tool Misuse
Domain
Other
Source
User Report

Related incidents

4.0
Claude Code's auto mode dropped a git stash after a partial restore, twice in one session
7.0
Claude Code ran git reset --hard origin/main at session startup and destroyed a user's uncommitted hardware-debugging work, on two consecutive days
6.0
Gemini CLI ran git commit --no-verify against explicit instructions, then git reset --hard wiped a sprint's worth of unstaged work
9.0
Claude Code ran prisma db push --force-reset on production, dropping all 87 tables instead of a safe schema change
Discuss on Hacker News
Cite this record
StupidLLM. "STUPID-2026-0162: Cursor silently ran git stash and git reset HEAD mid-agent-session, dropping 45 files of uncommitted work." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0162/ (accessed 2026-11-11). CC BY 4.0.

← STUPID-2026-0161By ID

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.

This database is callable over MCP — query it from inside your agent.