Human-in-the-Loop Task Manager for AI Agents
Checked October 30, 2026 | All YOLO Mode guides

How to Enable YOLO Mode in Cursor

To run Cursor's agent in YOLO mode from the terminal, start it with agent --yolo, which is an alias for --force. In the Cursor editor, YOLO is the Run Everything run mode. Both stop the approval prompts, and Run Everything also stops sandboxing shell commands.

This page is one of our YOLO mode guides, and part of our guide to YOLO mode in every coding agent. Everything below was checked against Cursor's CLI and run mode docs (cursor.com/docs, CLI build 2026.10.22) on October 30, 2026.

Animated sketch of YOLO mode in AgentRQ: claude waits to run go test, YOLO is flipped on for the task, and every later edit and test run lands auto-allowed in the Trajectory view

What YOLO Mode Turns Off in Cursor

Cursor calls its approval settings run modes. There are three:

Mode What runs without asking Sandbox
Auto-review Allowlisted calls. Other shell commands run in the sandbox when they can, and a classifier reviews the rest. Yes, for shell commands
Allowlist Only the actions on your allowlist Optional
Run Everything Every tool call No

Run Everything is Cursor's YOLO mode. It skips the prompts, the classifier and the sandbox, and Cursor's Read Access setting is hidden in this mode because nothing is checked.

--force in the CLI is slightly narrower. Cursor describes it as "force allow commands unless explicitly denied", so your deny rules still apply.

How to Enable YOLO Mode in Cursor

Where How
Editor Settings > Agents > Approvals & Execution > Run Everything
CLI flag agent --yolo, agent --force or agent -f
CLI session /run-everything on (alias /auto-run)
cli-config.json "approvalMode": "unrestricted"
bash 
agent --yolo "fix the failing tests"

In a running CLI session, /run-everything on turns it on, /run-everything off turns it off, and /run-everything status shows where you are. The CLI reads its settings from ~/.cursor/cli-config.json, where approvalMode takes allowlist, auto-review or unrestricted.

Print mode (agent -p) is for scripts and CI. Cursor's docs say the agent has full write access in non-interactive mode.

The Halfway Options

Auto-review is the mode Cursor recommends for most people. Turn it on in the editor's run mode setting, with --auto-review or /auto-review in the CLI. You can steer the classifier in plain English in ~/.cursor/permissions.json or <project>/.cursor/permissions.json:

json 
{
  "autoRun": {
    "allow_instructions": [],
    "block_instructions": ["Every AWS CLI command should go through approval first."]
  }
}

Cursor says plainly that Auto-review is not a security boundary: the classifier can be wrong in both directions.

Allowlist is the deterministic option. In the CLI, list what may run without asking in cli-config.json (or <project>/.cursor/cli.json). Deny rules beat allow rules:

json 
{
  "permissions": {
    "allow": ["Shell(git)", "Shell(npm)", "Read(src/**)", "Write(src/**)"],
    "deny": ["Shell(rm)", "Read(.env*)", "Write(**/.env*)"]
  }
}

The tokens are Shell(...), Read(...), Write(...), WebFetch(...) and Mcp(server:tool).

Cursor's Sandbox

Unlike most agents, Cursor has a real sandbox for shell commands: Seatbelt on macOS, and Landlock plus seccomp on Linux (kernel 6.2 or later). A sandboxed command can read and write the workspace, cannot touch protected paths like .git/hooks, and has no network unless sandbox.json opens it. In the CLI, control it with --sandbox enabled or --sandbox disabled, or with /sandbox.

Run Everything does not use it. If you want fewer prompts and still want the sandbox, use Auto-review or Allowlist with sandboxing on.

How to Enable YOLO Mode in Cursor Through AgentRQ

Cursor's own YOLO switch covers a whole machine or session. AgentRQ lets you make the decision per task, and answer from somewhere other than the terminal or the editor.

Approve From the AgentRQ Task Instead of the Terminal

Connect Cursor's CLI agent to an AgentRQ workspace through the ACP Gateway (Cursor setup guide):

bash 
npx @agentrq/acp-gateway@latest --agent cursor

The gateway runs Cursor's agent in ACP mode, where it sends a permission request whenever a tool needs approval. Keep Run Everything and approvalMode: "unrestricted" off, and don't pass --force: anything Cursor runs without asking never reaches AgentRQ. Each permission request now shows up in the AgentRQ task on the web, on your phone or in Slack, together with the command or edit it is asking about. Answer Allow Once, Always Allow or Deny from wherever you are, and Cursor carries on. If nobody answers within 30 minutes, the gateway cancels the turn instead of guessing. Change the limit with --permission-timeout.

Turn On YOLO for One Task

Flip the YOLO toggle on a task, or when you create it, to put just that task in YOLO mode. Every permission request in it is approved automatically and Cursor never waits, while every other task in the workspace still asks. Scheduled tasks, event triggers and workflow steps have the same switch, so an unattended job can run in YOLO while your interactive work stays supervised.

The YOLO toggle on a task in AgentRQ being switched on, then off again

Turn YOLO On or Off in Workspace Settings

To make YOLO the default for a whole workspace, open the workspace, go to Settings, choose the Automations tab and flip YOLO Mode (Execute All). Click Update Workspace to save. Switch it off the same way. The switch is off by default, and every permission request in the workspace is approved automatically while it is on.

Workspace Settings in AgentRQ: the YOLO Mode (Execute All) switch turned on and saved, then off and saved

A Safe YOLO Setup for Cursor

  • → Keep a deny list. permissions.deny in cli-config.json still applies under --force, so block Shell(rm), .env files and key files there.
  • → Allow the boring tools, not everything. Always Allow adds the tool to the workspace's auto-approved list, so the routine calls stop asking and the risky ones still do. Prune that list in workspace settings now and then.
  • → Leave the workspace-wide switch off. Turn YOLO on per task instead, so it never outlives the job you trusted.
  • → Keep the sandbox on. Cursor has one. Run Everything turns it off, so prefer Auto-review or Allowlist with sandboxing when you can.
  • → Commit first. Start every YOLO task from a clean git tree, so any change is one git reset away.
  • → Read the record. The tool call history lists every call the task made, including the ones that were auto-approved.

FAQ

How do I enable YOLO mode in Cursor? In the editor, open Settings > Agents > Approvals & Execution and choose Run Everything. In the CLI, run agent --yolo.

What does agent --force do in Cursor? It runs every command without asking unless a deny rule blocks it. --yolo and -f are the same flag.

Does Cursor's Run Everything mode use the sandbox? No. Run Everything runs every tool call with no sandbox and no classifier. Auto-review and Allowlist can sandbox shell commands.

What is the safer alternative to Run Everything in Cursor? Auto-review. Allowlisted calls run, other shell commands run in the sandbox, and a classifier reviews the rest. When it blocks a call, Cursor tries another way or asks you.

How do I approve Cursor commands remotely? Connect Cursor's CLI agent to AgentRQ through the ACP Gateway. Its permission requests show up in the task on the web, your phone or Slack.

For every other agent, see what YOLO mode is and how to turn it on in every coding agent.

Start Free