You let the agent read a handful of unfamiliar web pages with a fairly permissive browser allow list in place. Partway through it attempts a form submission on one of those pages that you never asked for and that appears nowhere in your prompt. What is the likely explanation, and what should change?

The principle — Browser allow and block lists give best-effort protection, not a boundary. Cursor's documentation says why: AI behavior can be unpredictable due to prompt injection and other issues, and it follows that advice with an instruction to review auto-approved actions regularly. Anything the agent reads — including a web page — enters the same context as your instructions, so text sitting on that page can read as an instruction.

Why the key is correct — A submission you never asked for, on a page you did not vet, is the signature of content on that page steering the agent. The response has two parts. Narrow what runs without approval, so that navigation and reading may proceed while clicks, typing and submissions on unfamiliar origins ask first. Then go back through the auto-approved actions already on the list and ask whether each one is something you would still grant to an arbitrary page, because a list that grew for convenience during trusted work is what carries you into untrusted work unchanged.

Why the others are wrong — Believing the agent acts only on your instructions sends you searching your own transcript for a request that was never made. Believing the allow list is a hard boundary turns an expected behaviour into a suspected corruption, and reinstalling changes nothing. And expecting a system prompt to immunise the model treats prompting as input filtering; it shapes behaviour, it does not screen out hostile text, and filing a bug leaves the permissive settings exactly as they were.

Remember this — Treat every page the agent reads as untrusted input, and let your approval settings, rather than your trust in the model, decide what a page can cause to happen.

Sources — Cursor's Browser tool documentation.