Skip to content
Rabin Poudyal
Page 9-1
9-1 Incidents

9.15Cursor's support bot invents a policy

A bug logged Cursor users out when they moved between machines, and an AI support agent signing as Sam told one of them it was a new one-device policy. There was no such policy.

Cursor · 14 April 2025 · AI in production

  1. 1Read
    Blast radius
    Users of the Cursor code editor caught by a session bug, and the company's standing with its own customers: the support reply was posted publicly, users said in the thread that they were cancelling, and the story reached the front page of Hacker News.
    Duration
    Users on Cursor's forum reported the logouts from 10 April 2025. The invented policy was public for about three hours on 14 April, from the screenshot at 13:32 Coordinated Universal Time (UTC) to Cursor's denial at 15:54 UTC. Cursor's co-founder said on 16 April that a fix had rolled out.
  2. 2Follow

    What happened, in order

    1. 10 Apr 2025

      A thread on Cursor's forum reports frequent automatic logouts when using more than one device. Users later say it started about a week earlier.

    2. 14 Apr, 09:42 UTC

      A Cursor staff member replies on the forum that the logouts probably come from recent changes with unintended side effects, and should be resolved within 24 hours.

    3. 14 Apr, 12:54 UTC

      A user posts on Reddit's r/cursor that logging in on one machine immediately invalidates the session on any other, calling it a new policy.

    4. 14 Apr, 13:32 UTC

      The same user posts a screenshot of the support email, signed "Sam": Cursor "is designed to work with one device per subscription as a core security feature", and work and home machines each need a separate subscription. Nothing in it says the reply came from AI.

    5. 14 Apr, 14:05 to 14:53 UTC

      Users in the thread say they are cancelling or looking at alternatives. One replies that Sam is an AI, not a real person, so it might be saying the wrong thing.

    6. 14 Apr, 15:54 UTC

      Michael Truell, Cursor's co-founder, replies on Reddit: there is no such policy, users are free to use Cursor on multiple machines, and the reply was an incorrect response from a front-line AI support bot.

    7. 14 Apr, 16:24 UTC

      The thread is posted to Hacker News. The Reddit post is later removed by a moderator and locked.

    8. 16 Apr, 02:52 UTC

      Truell posts on Hacker News: AI responses used for email support are now clearly labelled, the user has been refunded, the logouts came from a race condition, and a fix has been rolled out.

  3. 3Find

    Root cause

    Note

    There were two faults, one in the product and one in support. In the product, Cursor had rolled out a change to improve the security of sessions. By Truell's later account, a race condition that appeared on very slow internet connections created a burst of unneeded sessions, which crowded out the real ones, so users were logged out. Forum users at the time described a single login creating more than ten active sessions.

    In support, Cursor used AI-assisted responses as the first filter for email, and at the time every support email went through it. A user asked why switching machines logged them out. The answer explained the bug as intended behaviour, stated a policy, "one device per subscription as a core security feature", and recommended buying a second subscription. Nothing about Cursor's internal set-up is public beyond that, and this page does not guess at it. What is public is the outcome: a confident, plausible and false statement of company policy, sent in the company's name.

    A bug explained as a policy Cursor rolled out a change to improve session security. A race condition on slow connections created unneeded sessions that crowded out real ones, so users were logged out. A user asked support why, and an AI support reply signed Sam, with nothing in it saying it was AI, said Cursor allowed one device per subscription and each device needed its own. The reply was posted on Reddit, then Hacker News, and users said they were cancelling. Cursor said there was no such policy, labelled AI support replies, refunded the user and rolled out a fix between 14 and 16 April 2025. The product The bug The symptom The question Session change to improve security Race condition on slow connections Extra sessions crowd out real ones User asks support why am I logged out? AI support reply signed Sam, by email Invented policy new plan for each device Public thread Reddit, then HN Cancellations posted by users Cursor: no such policy; AI support replies now labelled; the user refunded and a fix rolled out, 14 to 16 April 2025
    A session bug logged users out, an AI support reply signed with a human name explained the bug as policy, and the reply travelled faster than the fix.
  4. 4Trace

    Why it got through

    The reply looked like it came from a person. It was signed with a human name and the company's support address, and nothing in it said it was generated. A customer had no reason to discount it, and a user in the thread had to point out that Sam was an AI. Once a statement of policy arrives from the company's own support address, its readers treat it as the company's position, and here they did, in public.

    The answer was plausible because it was close to things Cursor staff had said. Before the incident, forum staff had told users that using one account on several machines at the same time could get it flagged for abuse. A one-device rule was a short step from there, and a bug that logged people out on every switch looked exactly like such a rule being enforced. Nothing stood between the drafted answer and the customer for a question about rules and money, the kind a person should answer.

  5. 5Check

    The lesson

    An AI agent speaking to customers is speaking for the company. Ground its answers in real policy, label it as AI, and route anything about rules, money or accounts to a person before it is sent.

  6. 6Change

    What changed afterwards

    Cursor said that any AI responses used for email support were now clearly labelled as such, that the affected user had been fully refunded, and that a fix for the race condition had rolled out. Asked whether all Cursor email inboxes were gated by AI, Truell said its support system was, but not every inbox, and that the company was standing up a much bigger support team but was behind where it should be.

    On the forum, Cursor staff asked users still seeing logouts to confirm the fix on 15 and 17 April. Cursor's public changelog for the releases of that period does not mention the session bug.

  7. 7Verify

    Where the sources differ

    • The brief says there was no one-device policy. Cursor's denial is about Sam's claim, a separate subscription for each device. Its forum staff had said, before and during the incident, that simultaneous use on several machines was not supported and could get an account flagged, and one staff reply on 14 April said "you can only use Cursor on one machine at a time at once".
    • Cursor described the cause two ways. On Reddit on 14 April Truell said it had rolled out a change to improve the security of sessions, later edited to say it was investigating whether that caused problems with session invalidation; on Hacker News on 16 April he described a race condition on slow connections. Another staff member's first guess was "an anti-fraud measure bug". This page treats the Hacker News account as the latest, without merging them.
    • "Hallucinated" and "made up" are the words of the Hacker News title and the press. Cursor's words were "an incorrect response from a front-line AI support bot".
    • The screenshot carries no date, so when the email was sent is not known. The labelling was announced as already done on 16 April, which suggests the earlier replies were not labelled, but Cursor did not say so outright. Cursor named a refund for this one user only.
    • Reddit blocks automated access, so the thread was read from archived copies; by the time the first was taken the post's body had been removed, and its original text and the comments come from a Reddit archive.
  8. 8Source

    Sources

  9. 9Go