Cursor's Support Bot Sam Invented a Login Policy, and Users Quit Over It
- Date
- Apr 2025
- Tools involved
- Cursor
- Impact
- Users publicly canceled subscriptions over a fabricated single-device policy; Cursor's co-founder issued a public apology
- Root cause
- An AI support agent hallucinated a nonexistent policy to explain logouts caused by a session-management race condition
What happened
In April 2025, users of Cursor, the AI code editor built by Anysphere, started getting unexpectedly logged out when they switched devices. The cause was a session-management race condition that hit on slow connections. Annoying, but ordinary: the kind of bug that gets a ticket and a fix.
The escalation came from support. Users who emailed in got replies from 'Sam,' an AI-powered support agent, explaining that the logouts were expected behavior under a policy limiting subscriptions to a single active device. No such policy existed. Sam had hallucinated it, and because the reply looked like an official human response, users believed it.
The invented rule spread on Reddit and Hacker News, and developers who rely on multi-device workflows publicly canceled their subscriptions in protest. A Cursor representative eventually stepped into the Hacker News thread to say the company had 'no such policy,' and co-founder Michael Truell issued a public apology, attributing the message to an AI hallucination and confirming the underlying session bug had been fixed.
Covered by Fortune and cataloged in the AI Incident Database, the episode became a canonical warning about handing support queues to AI agents that can fabricate company policy with total confidence.
Impact
The direct damage was churn and trust. Developers who depend on multi-device workflows publicly canceled subscriptions over a policy that never existed, and the invented rule circulated on Reddit and Hacker News as if it were an official announcement. Cursor had to spend a public apology from its co-founder to unwind a support reply that nobody at the company wrote.
Root cause
Two failures stacked. First, a session-management race condition on slow connections logged users out when they switched devices, creating a wave of confused support emails. Second, an AI support agent answered those emails by hallucinating a single-device policy and presenting it as fact, with no human review and no grounding in Cursor's actual policies. The bug caused the symptom; the bot manufactured the explanation.
How to not be this entry
- Label AI-generated support replies as AI. Cursor's users believed 'Sam' because the email read like an official human response; give people the context to double-check.
- Ground support bots in a real policy document and block them from answering policy questions they cannot cite. A model with no source produces a confident answer anyway. Read the fix guide: Claude Code Says 'You're Absolutely Right!' and Keeps Applying the Same Broken Fix
- Route account, billing, and policy questions through human review before the reply sends. Those are exactly the answers users screenshot and share.
- Monitor Reddit and Hacker News for your product name. Cursor's invented policy spread in public threads before the company responded, and the correction had to happen there too.
Tools that actually fix this
Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.
An AI reviewer that reads the diff and flags security bugs, missing error handling, and sketchy dependencies before the AI's code merges. The safety net vibe coding skips, and free for individuals.
Try CodeRabbit →An AI code reviewer that understands your whole codebase, so it catches the cross-file bug an AI edit introduces two files away. Free tier for individuals.
Try Greptile →Frequently asked questions
Did Cursor ever have a single-device login policy?
No. Cursor never enacted a single-device policy. The claim came from 'Sam,' an AI-powered support agent that hallucinated the rule when users asked why they were being logged out, and a Cursor representative later confirmed on Hacker News that the company had 'no such policy.'
Why were Cursor users getting logged out in April 2025?
The logouts were caused by a session-management race condition that hit users on slow connections when they switched devices. It was a genuine bug, not a policy. Co-founder Michael Truell confirmed the underlying session bug was fixed after the incident.
Who or what is 'Sam' at Cursor?
Sam was an AI-powered support agent that answered Cursor support emails. Its replies looked like official human responses, so when it invented a single-device policy to explain a logout bug, users had no reason to doubt it. The incident made Sam a canonical example of an AI support bot fabricating company policy.
How did Cursor respond to the fake policy incident?
A Cursor representative stepped into the Hacker News thread to state that no single-device policy existed, and co-founder Michael Truell issued a public apology attributing the support message to an AI hallucination. Cursor also confirmed the session bug behind the logouts had been fixed.
Sources
- Fortune: How Cursor's customer support AI went rogue
- Hacker News: thread on Cursor logouts and the 'Sam' single-device policy reply
- AI Incident Database: Incident 1039, Cursor support bot fabricates a policy
Related error guides
Claude Code Says 'You're Absolutely Right!' and Keeps Applying the Same Broken Fix
Cursor Forgot Everything Mid-Chat (Context Loss in Long Sessions)
The Vibe Oops briefing
One email when something ships to production that should not have. New incidents, new error guides, no filler.