An enterprise administrator switches on the Browser Origin Allowlist in the dashboard, adds no entries, saves the configuration, and announces to the organisation that agent browsing is now confined to approved sites. Auditors take the announcement at face value. What is the real state of automatic navigation?

The principle — For Cursor's Browser Origin Allowlist, empty means open. The documentation states it directly: leave the allowlist empty to allow all origins. The feature is off in the sense that matters, not locked down, and enabling it without adding entries changes nothing about where the agent may navigate automatically.

Why the key is correct — The administrator performed the enabling step and skipped the restricting step. Automatic navigation is therefore unrestricted, while the organisation has been told the opposite. That gap is the real damage. A control believed to be in force stops people asking the questions they would otherwise ask about the agent visiting unfamiliar sites, and an auditor who trusts the announcement records a restriction that no configuration implements. The fix is a single deliberate entry — even a narrow one — followed by checking the dashboard rather than the memory of having saved it.

Why the others are wrong — Expecting deny-by-default is the trained instinct from firewalls and permission systems, and it is the exact misreading this setting punishes. Expecting a curated default set of development and documentation origins is the more dangerous belief, because it sounds accommodating and leads straight to signing the audit off. And treating a blank save as a no-op that preserves earlier settings assumes blank means unset; here blank is a value, and its value is everything.

Remember this — Verify a browser restriction by observing it, not by remembering that you configured it. Ask the agent to navigate somewhere the policy should refuse and watch what happens. Any setting where an empty field means permissive deserves that check every time, because the failure mode is silent: nothing errors, nothing warns, and the only symptom is a control that was never there.

Sources — Cursor's Browser tool documentation.