A developer shares a public link to a Cursor chat in order to show a colleague one clever refactor near the end of it. What else does that link publish?

The principle — Sharing a chat shares the full conversation history: the prose, the code snippets, the tool calls the agent made, and the results those calls returned. Nothing is collapsed or summarised on the way out.

Why the key is correct — Tool output is where the exposure usually lives. A single long run may have printed environment variables, a database connection string, an internal hostname, a stack trace naming a private service, or several files of proprietary source that the agent read into the conversation. The developer remembers the refactor at the end; the link carries everything that came before it. A public link means anyone holding it, with no sign-in required, and anyone who copies the contents keeps them after the transcript is deleted from the dashboard.

Why the others are wrong — Believing that only the prose is published is the most expensive version of this mistake, because it removes any reason to reread the conversation before sharing. There is no summarisation step that trims command results down to status lines. And the transcript does not reach into the workspace: files on disk are excluded, although anything already quoted into the chat is part of the conversation and goes with it.

Remember this — Read a transcript from the top before sharing it, paying attention to what commands printed rather than to what the agent said. Where there is any doubt, a team link is the smaller blast radius.

Sources — Cursor's Shared transcripts documentation.