How to Stop a Goal-Seeking Agent From Thrashing: Travis McPeak, Security Lead at Cursor "Most of the time, 'It deleted my database,' is actually not going be a prompt injection. It's going be thrash." @travismcpeak, security lead at @cursor_ai, talked to us at Black Hat about what actually causes coding agents to go wrong. When an agent is trying hard to solve a problem and gets stuck, it starts getting creative. He calls it thrash, and he walked us through what Cursor built to stop it. We get into: > Why block lists and WAFs break down against an agent whose whole job is to find a way through > Why an agent can't monitor itself, and what a reviewer that has a different goal catches instead > How Cursor's auto review sees every tool call before it fires, and why the feedback had to be worded carefully > Why blocking an action can cause the exact thrash you were trying to prevent > Why least privilege finally scales now TIMESTAMPS (01:30) Travis McPeak, security lead at Cursor, live from Black Hat (02:45) Why block lists and WAFs break down against a creative agent (03:20) Why an agent can't course correct itself (03:40) Thrash: what actually deleted your database (04:15) Inside Cursor's auto review, and wording the feedback so the main agent doesn't spiral (06:00) Least privilege that finally scales (07:00) Layered defense: permissions are the boundary, review and proxy decide the rest (09:00) What a software factory needs: validators, canaries, observability, a fast loop (11:40) An error, a left turn, and an agent going off the rails (13:00) Agents as early-career employees: tell them to stop and ask (15:40) The sudo deny list, and the Python script that sails right past it (18:30) Agent identity: person, bot, or bot on behalf of me (23:45) The 500-character shell command, 200 approvals, and consent fatigue (26:45) Reacting at machine speed