Cursor requires your manual approval for sensitive agent actions by default. What is that requirement primarily defending against?

The principle — Cursor's guardrails exist because AI can behave unexpectedly through prompt injection, hallucination and other issues. By default, sensitive actions require your manual approval.

Why the key is correct — The threat is content the agent reads: a fetched page, a dependency file or a code comment carrying instructions the agent follows as though you had typed them. The approval prompt is where a human notices that a request nobody made is about to run.

Why the others are wrong — The prompts are not there to catch misclicks, so turning them off removes a defence, not a nuisance. They are not a pacing or cost control either, and they do not guard against interrupted tool calls; version control covers a half-finished change.

Remember this — Every approval you switch off decides what injected text may do unopposed.

Sources — Cursor's Agent Security documentation.