AI failures · Unauthorized commitment
Cursor 'Sam' AI Support Bot Invents One-Device Login Policy — Users Cancel Subscriptions
Verified Checked against its sources on 2 sources quoted
- Where it happened
- International or several countries
- Organization
- Anysphere (Cursor)
- Date
- Week of April 14, 2025 (Ars Technica, April 17, 2025, dates the first user report to the preceding Monday)
- Function
- Customer Support
- Where it happened
- Customer support; subscription management
- System
- Cursor 'Sam' AI support bot
- Technology
- Generative AI
- Type of failure
- Unauthorized commitment
- Caught by
- A client or customer
Summary
Users of Anysphere's Cursor code editor found they were being logged out when switching between machines. A user who emailed support received a reply from 'Sam', an AI support bot, saying Cursor was designed to work on one device per subscription as a security feature. No such policy existed. The reply spread on Reddit and Hacker News and users reported cancelling subscriptions; a Cursor representative and co-founder Michael Truell then posted that there was no such policy and that the answer had come from a front-line AI support bot.
Consequence
- Users publicly reported cancelling their subscriptions.
- Cursor publicly retracted the bot's answer and acknowledged it came from a front-line AI support bot.
Who caught it A client or customerFound outside the organization
Analysis
What could have been done
Limits on what the system may decide or commit to
The AI's authority to decide, commit or act is defined, bounded and approved by a person above set thresholds.
An AI support bot replied to a customer by email that Cursor was designed to work on one device per subscription as a security feature; no such policy existed, and users reported cancelling their subscriptions.
A named owner and disclosure of AI use
A named person owns the AI-assisted output, and its use is disclosed to those relying on it.
The reply came from 'Sam', and the company stated that it was a front-line AI support bot only after the reply had spread on Reddit and Hacker News.
What would likely have prevented it
- Restrict an AI support bot to answering from the documented policy set, and route any account, licensing or subscription question the documents do not answer to a person.
- Identify AI-written support replies to customers as AI-written.
What would likely have caught it earlier
- Review a daily sample of AI support replies for statements of policy, and check each one against the documented policy.
Key dates
- April 14, 2025Event
- October 16, 2026Checked against sources
- October 18, 2026Checked against sources
- October 21, 2026Checked against sources
Developments are added when the record is reviewed. Next review: October 16, 2027.
Evidence
Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.
-
But there was no new policy—and no human behind the support email. The response had come from an AI-powered bot and the new policy was a “hallucination,” an entirely made-up explanation. The news spread rapidly in the developer community, leading to reports of users cancelling their subscriptions
Supports: Policy did not exist; reply came from an AI bot; cancellations
-
“Cursor is designed to work with one device per subscription as a core security feature,” read the email reply.
Supports: Content of the bot's invented policy
“Hey! We have no such policy,” wrote a Cursor representative in a Reddit reply three hours later. “You’re of course free to use Cursor on multiple machines. Unfortunately, this is an incorrect response from a front-line AI support bot.”
Supports: Company retraction and acknowledgment
Suggested citation. Eminence Scan, “Cursor 'Sam' AI Support Bot Invents One-Device Login Policy — Users Cancel Subscriptions”, Eminence Growth Solutions, last verified October 16, 2026, https://eminencegrowthsolutions.com/tools/eminence-scan/record/fail-024/.
Using our research: you may read and quote Eminence Scan with credit to “Eminence Scan, Eminence Growth Solutions” and a link; all other rights reserved. Terms: Using our research.
Spotted an error, or a development we have missed? Report a correction. How we check records: research methodology.