A chat window can only produce text, and you decide what happens to that text. Claude Code and Cursor run the same models inside a program that opens your files, writes to them and runs commands. Nothing about the model changed. Its reach did.

The idea

An only ever does what the program around it permits, and you granted that permission, sometimes by clicking quickly. The useful question about an agent is never how clever it is. It is what it can touch, and what happens when it is wrong.

code
  YOU            THE PROGRAM (Claude Code, Cursor)        YOUR MACHINE
  ---            ---------------------------------        ------------

  request  -->   [ model emits a request ]
                          |
                 "read src/app.ts"    -> [ allowed?  ] ->  files, read
                 "write src/app.ts"   -> [ ask you?  ] ->  files, written
                 "run npm run build"  -> [ ask you?  ] ->  the shell
                 "fetch this page"    -> [ allowed?  ] ->  the network
                          |
  answer   <--   [ result goes back into the conversation ]

                 the model executes nothing itself.
                 every gate above lives in the program.

How it works

The model emits a request, the program decides whether it runs, and the result is fed back into the conversation. Permission lives in the program, not in the model. A model that is confused, or that has read something written to manipulate it, still cannot exceed what the program allows.

What the program allows differs by product, and is worth reading once for the one you use. Checked 13 August 2026:

  • Claude Code documents read-only defaults, an explicit prompt before edits and before commands apart from a built-in set of read-only ones, and a working directory boundary it will not write outside of without further approval.
  • Cursor defaults to a mode called Auto-review, where allowlisted calls run immediately and other shell commands run in a sandbox without asking you. Anything that cannot be sandboxed goes to a classifier that decides. Cursor's own documentation says plainly that "Auto-review is not a security boundary" and that the classifier can make mistakes in both directions.
  • The Copilot cloud agent moves the work off your machine entirely. It runs in an ephemeral GitHub Actions environment, explores the code, changes it, runs the tests, and hands back a pull request. Your disk is untouched and the review is the gate.

Anything an agent fetches from the web is untrusted input. A page can carry instructions written to be read by the model rather than by you (), so browsing is worth gating more tightly than reading your own files.

What to do

  1. Put the project under before you allow the first write. Cursor's own documentation supplies the reason: changes save straight to disk, so the undo has to exist already.
  2. Approve in the moment, and add to the only when calm. One approval decides one command. An allowlist entry decides every future one, and people write them while impatient.
  3. Keep what you cannot undo out of reach. Keep production credentials outside the folder the agent works in, point its database settings at a copy rather than the live one, and put the deploy command on the deny list rather than merely leaving it off the allowlist. Leaving something off an allowlist only means you get asked, and being asked on a tired afternoon is not a boundary.

Where it breaks

The real failure is fatigue, not a dramatic command. Forty approvals in an afternoon train you to approve the forty-first without reading, and that is the one that mattered. Allowlists cut the number down, which genuinely helps, and every entry is permanent while your attention is not.

Approval is a question about whether you understood, and often you will not. A long command doing one useful thing and one destructive thing still looks like a long command.

Refusing all reach has its own cost. An agent that can run the test and read the failure corrects itself. One that can only produce text needs you as its hands at every step. What works is a boundary small enough that you still read what crosses it.