---
title: "How to Enable YOLO Mode in Cursor | AgentRQ Guidelines"
url: https://agentrq.com/guidelines/yolo-mode/cursor
description: "Cursor YOLO mode: agent --yolo (an alias of --force) in the CLI, Run Everything in the editor, approvalMode in cli-config.json, and the sandbox it drops."
---

![](https://agentrq.com/assets/agent-icons/cursor.png) Checked October 30, 2026 | [All YOLO Mode guides](https://agentrq.com/guidelines/yolo-mode/)

# How to Enable YOLO Mode in Cursor

To run Cursor's agent in YOLO mode from the terminal, start it with `agent --yolo`, which is an alias for `--force`. In the Cursor editor, YOLO is the **Run Everything** run mode. Both stop the approval prompts, and Run Everything also stops sandboxing shell commands.

This page is one of our [YOLO mode guides](https://agentrq.com/guidelines/yolo-mode/), and part of our guide to [YOLO mode in every coding agent](https://agentrq.com/blog/what-is-yolo-mode-and-how-to-turn-it-on-in-every-coding-agent). Everything below was checked against Cursor's CLI and run mode docs (cursor.com/docs, CLI build 2026.10.22) on October 30, 2026.

![Animated sketch of YOLO mode in AgentRQ: claude waits to run go test, YOLO is flipped on for the task, and every later edit and test run lands auto-allowed in the Trajectory view](https://agentrq.com/assets/sketches/yolo-mode.svg)

## What YOLO Mode Turns Off in Cursor

Cursor calls its approval settings **run modes**. There are three:

| Mode | What runs without asking | Sandbox |
| --- | --- | --- |
| Auto-review | Allowlisted calls. Other shell commands run in the sandbox when they can, and a classifier reviews the rest. | Yes, for shell commands |
| Allowlist | Only the actions on your allowlist | Optional |
| Run Everything | Every tool call | No |

Run Everything is Cursor's YOLO mode. It skips the prompts, the classifier and the sandbox, and Cursor's **Read Access** setting is hidden in this mode because nothing is checked.

`--force` in the CLI is slightly narrower. Cursor describes it as "force allow commands unless explicitly denied", so your deny rules still apply.

## How to Enable YOLO Mode in Cursor

| Where | How |
| --- | --- |
| Editor | Settings > Agents > Approvals & Execution > Run Everything |
| CLI flag | `agent --yolo`, `agent --force` or `agent -f` |
| CLI session | `/run-everything on` (alias `/auto-run`) |
| cli-config.json | `"approvalMode": "unrestricted"` |

bash

```bash
agent --yolo "fix the failing tests"
```

In a running CLI session, `/run-everything on` turns it on, `/run-everything off` turns it off, and `/run-everything status` shows where you are. The CLI reads its settings from `~/.cursor/cli-config.json`, where `approvalMode` takes `allowlist`, `auto-review` or `unrestricted`.

Print mode (`agent -p`) is for scripts and CI. Cursor's docs say the agent has full write access in non-interactive mode.

### The Halfway Options

**Auto-review** is the mode Cursor recommends for most people. Turn it on in the editor's run mode setting, with `--auto-review` or `/auto-review` in the CLI. You can steer the classifier in plain English in `~/.cursor/permissions.json` or `<project>/.cursor/permissions.json`:

json

```json
{
  "autoRun": {
    "allow_instructions": [],
    "block_instructions": ["Every AWS CLI command should go through approval first."]
  }
}
```

Cursor says plainly that Auto-review is not a security boundary: the classifier can be wrong in both directions.

**Allowlist** is the deterministic option. In the CLI, list what may run without asking in `cli-config.json` (or `<project>/.cursor/cli.json`). Deny rules beat allow rules:

json

```json
{
  "permissions": {
    "allow": ["Shell(git)", "Shell(npm)", "Read(src/**)", "Write(src/**)"],
    "deny": ["Shell(rm)", "Read(.env*)", "Write(**/.env*)"]
  }
}
```

The tokens are `Shell(...)`, `Read(...)`, `Write(...)`, `WebFetch(...)` and `Mcp(server:tool)`.

### Cursor's Sandbox

Unlike most agents, Cursor has a real sandbox for shell commands: Seatbelt on macOS, and Landlock plus seccomp on Linux (kernel 6.2 or later). A sandboxed command can read and write the workspace, cannot touch protected paths like `.git/hooks`, and has no network unless `sandbox.json` opens it. In the CLI, control it with `--sandbox enabled` or `--sandbox disabled`, or with `/sandbox`.

Run Everything does not use it. If you want fewer prompts and still want the sandbox, use Auto-review or Allowlist with sandboxing on.

## How to Enable YOLO Mode in Cursor Through AgentRQ

Cursor's own YOLO switch covers a whole machine or session. AgentRQ lets you make the decision per task, and answer from somewhere other than the terminal or the editor.

### Approve From the AgentRQ Task Instead of the Terminal

Connect Cursor's CLI agent to an AgentRQ workspace through the [ACP Gateway](https://agentrq.com/docs/connect-acp-agent) ([Cursor setup guide](https://agentrq.com/docs/agents/cursor)):

bash

```bash
npx @agentrq/acp-gateway@latest --agent cursor
```

The gateway runs Cursor's agent in ACP mode, where it sends a permission request whenever a tool needs approval. Keep Run Everything and `approvalMode: "unrestricted"` off, and don't pass `--force`: anything Cursor runs without asking never reaches AgentRQ. Each permission request now shows up in the AgentRQ task on the web, on your phone or in Slack, together with the command or edit it is asking about. Answer **Allow Once**, **Always Allow** or **Deny** from wherever you are, and Cursor carries on. If nobody answers within 30 minutes, the gateway cancels the turn instead of guessing. Change the limit with `--permission-timeout`.

### Turn On YOLO for One Task

Flip the **YOLO** toggle on a task, or when you create it, to put just that task in [YOLO mode](https://agentrq.com/features/yolo-mode). Every permission request in it is approved automatically and Cursor never waits, while every other task in the workspace still asks. [Scheduled tasks](https://agentrq.com/features/task-scheduling), [event triggers](https://agentrq.com/features/events) and [workflow](https://agentrq.com/features/workflows) steps have the same switch, so an unattended job can run in YOLO while your interactive work stays supervised.

![The YOLO toggle on a task in AgentRQ being switched on, then off again](https://agentrq.com/assets/guidelines/yolo-mode-task-toggle.gif)

### Turn YOLO On or Off in Workspace Settings

To make YOLO the default for a whole workspace, open the workspace, go to **Settings**, choose the **Automations** tab and flip **YOLO Mode (Execute All)**. Click **Update Workspace** to save. Switch it off the same way. The switch is off by default, and every permission request in the workspace is approved automatically while it is on.

![Workspace Settings in AgentRQ: the YOLO Mode (Execute All) switch turned on and saved, then off and saved](https://agentrq.com/assets/guidelines/yolo-mode-workspace-settings.gif)

### A Safe YOLO Setup for Cursor

- → **Keep a deny list.** `permissions.deny` in `cli-config.json` still applies under `--force`, so block `Shell(rm)`, `.env` files and key files there.
- → **Allow the boring tools, not everything.** **Always Allow** adds the tool to the workspace's auto-approved list, so the routine calls stop asking and the risky ones still do. Prune that list in workspace settings now and then.
- → **Leave the workspace-wide switch off.** Turn YOLO on per task instead, so it never outlives the job you trusted.
- → **Keep the sandbox on.** Cursor has one. Run Everything turns it off, so prefer Auto-review or Allowlist with sandboxing when you can.
- → **Commit first.** Start every YOLO task from a clean git tree, so any change is one `git reset` away.
- → **Read the record.** The [tool call history](https://agentrq.com/features/tool-call-history) lists every call the task made, including the ones that were auto-approved.

## FAQ

**How do I enable YOLO mode in Cursor?** In the editor, open Settings > Agents > Approvals & Execution and choose Run Everything. In the CLI, run `agent --yolo`.

**What does agent --force do in Cursor?** It runs every command without asking unless a deny rule blocks it. `--yolo` and `-f` are the same flag.

**Does Cursor's Run Everything mode use the sandbox?** No. Run Everything runs every tool call with no sandbox and no classifier. Auto-review and Allowlist can sandbox shell commands.

**What is the safer alternative to Run Everything in Cursor?** Auto-review. Allowlisted calls run, other shell commands run in the sandbox, and a classifier reviews the rest. When it blocks a call, Cursor tries another way or asks you.

**How do I approve Cursor commands remotely?** Connect Cursor's CLI agent to [AgentRQ](https://agentrq.com) through the ACP Gateway. Its permission requests show up in the task on the web, your phone or Slack.

For every other agent, see [what YOLO mode is and how to turn it on in every coding agent](https://agentrq.com/blog/what-is-yolo-mode-and-how-to-turn-it-on-in-every-coding-agent).