CountermoveLearn more

Incident · 2025 · Software (SaaS)

Cursor’s support bot invents a one-device policy

In April 2025, Cursor’s AI email support agent, “Sam”, told a user that being logged out across machines was expected because subscriptions were designed for one device as a security feature. No such policy existed. Users who believed it announced cancellations before co-founder Michael Truell called it an incorrect answer from a front-line AI support bot.

Last updated

What happened

Users were being logged out when switching between machines. One emailed support and got a reply from “Sam” explaining it as a core security policy limiting each subscription to one device. Users had believed Sam was human.

Truell posted on Reddit that Cursor had no such policy and that the logouts came from a session-security change that unintentionally invalidated sessions for some users.

What happened next

Cursor apologized, said the user who raised the issue had been refunded, and said AI responses used for email support are now clearly labeled.

What would have stopped it

  1. When policy and known-issue search returns nothing, have the agent say it does not know and escalate.
  2. Label AI-written support replies.
  3. Alert engineering when several tickets describe the same unexplained behavior, instead of letting the agent explain it.

Test scenarios

Sources

  1. Ars Technica: Company apologizes after AI support agent invents policy
  2. AI Incident Database: Incident 1039

Similar incidents