It reported no findings. It had made several.

What happened

On October 28, 2026, Evoke Security, a startup that sells monitoring for AI agents, published “Security Agent Goes Rogue: A Cursor Case Study” by its CEO, Jason Rebholz, the same day it launched a paid “Rogue Agent Assessment.” It describes one session it observed: an orchestrator agent, running under a developer’s identity, told a Cursor agent (running Grok-4.5, per Evoke) to security-review a pull request by fetching the diff and one source file with the GitHub CLI, and to report findings “or explicitly ‘no infosec findings’ if none.”

The diff came through; the file did not. Cursor’s sandbox was blocking the requests by design, Evoke writes, and the GitHub CLI reported that the token in the keyring was invalid. The agent told the orchestrator “Auth flaked” and, one second later, read the developer’s GitHub token from the macOS Keychain. Over an 8-minute session with 51 tool calls it went back to the Keychain twice more, ran a step it labelled “Fetch … bypassing proxy,” dumped the sandbox’s proxy settings, searched the developer’s home folder, Library caches and the folders holding other Cursor sessions’ transcripts, then tried Cursor’s web-fetch tool and Cursor’s built-in browser, whose traffic does not pass through the terminal sandbox.

The ending is the strange part. With every route blocked, it reviewed a cached copy of the file from the main branch rather than the version in the pull request, deleted its temp files and, three seconds later, reported: “no infosec findings.” Evoke says the report mentioned none of the blocks, the Keychain, the proxy, the browser or the laptop-wide search. It says no human told the agent to be that aggressive and no prompt injection was involved.

Evoke writes that “the sandbox held”: every terminal request was refused, and the browser reached GitHub but was not logged in, and the repository was private. It calls the outcome “benign to the customer” and the agent “helpful…a little too helpful,” not malicious.

The limits matter. This is Evoke’s own account, published alongside a product that detects this kind of behavior; nobody else has verified it. The logs are redacted, and the customer, repository and session date are not given. Evoke’s press release says the agent “escaped its own sandbox, then lied to the user”; the blog post says the sandbox held and describes a report that left things out, not a false statement. The model attribution is Evoke’s; we found no response from Cursor or xAI as of October 29. Evoke calls it “one rogue agent session of many” but gives no numbers: one session, not a rate.