🚨 Cursor AI Bug Burned 91.7M Tokens in 1 Sec, Stole $278.25 After Cancellation, and Censored My Forum Report

⚠️ STOP AND CHECK YOUR BANK STATEMENTS & CURSOR BILLING SETTINGS IMMEDIATELY.

If you have a credit card saved on Cursor (Anysphere, Inc.), your money is not safe. Over the past 19 days, Cursor’s broken billing infrastructure has illegally drained $278.25 from my card, remotely overridden my spending limits, and is still attempting to steal more money ($80.34 today) weeks after I canceled my account and stopped using the software.

Worse: when I posted the forensic server logs on Cursor’s official community forum earlier today to warn other developers, Cursor moderators immediately unlisted and silenced the thread—while their broken bot told me to email [email protected] (Elon Musk's xAI, a completely different company!).

Here is the undeniable forensic proof from Cursor’s own servers:

1. The Initial Theft ($236.13) & Post-Cancellation Robbery ($42.12)

• October 25, 2026: Without any human initiation or consent, Cursor hit my Visa card with 5 consecutive unauthorized charges totaling $236.13 ($60.21, $95.65, $40.24, $20.03, and $20.00).
• I immediately opened Ticket T-I38194, canceled my subscription, revoked all active sessions, set my spending limit to $0, and completely stopped using Cursor.
• October 27, 2026: Two days AFTER I canceled and locked my account, Cursor brazenly charged me another $42.12—bringing the total stolen to $278.25.

2. Forensic Proof from Cursor’s Own CSV Logs: An Internal Server Loop Charging Customers

I audited Cursor’s raw server-side usage logs (CSV), and what I found should terrify every developer and enterprise using this tool:

• Forced Unauthorized Upgrade: Cursor’s backend unilaterally upgraded my standard setup (composer-2.5) to the expensive Cursor Ultra plan without any human permission.
• Rogue Concurrent Agents: Logs show duplicate processes (Agent bc-3e7de778 and Agent bc-c2ceca7f) executing simultaneously in a loop on the same repository branch.
• Internal Recursive Loop: Their own logs expose an unmapped internal system process (bc-0e71d291-3258-57a4-9e3c-7a08938ad114) explicitly tagged source: internal and originalModelName: null.
• Physically Impossible Billing: This internal server loop burned 91,751,986 tokens in ONE SINGLE SECOND—generating automated charges of $41.56 PER SECOND. Cursor is literally billing customers out of pocket for its own broken backend loops!

3. Remote Security Tampering & Today’s New $80.34 Extortion Attempt (Nov 13)

It gets worse. I have not touched Cursor once since October 25. Yet when I checked my account today (November 13, 2026):

• Settings Overridden Remotely: My $0 Monthly Limit was mysteriously re-enabled without my consent.
• Ghost Usage: My dashboard shows 36.7 MILLION "On-Demand" tokens burned on an active "Ultra" plan while the app wasn't even installed on my machine.
• Brazen New Charge Attempt: Cursor just sent me a billing failure notice demanding another $80.34—the only reason they didn't steal it is because my bank blocked the card!

4. Zero Human Support, Censorship & Holding Credit Cards Hostage

For 19 straight days (Ticket T-I38194), Anysphere/Cursor has refused to assign a single human being to investigate this breach. Every urgent escalation is met with useless, copy-paste AI bot replies. They refuse to delete my credit card from their database and Stripe, and they actively censor forum posts exposing the bug.

Regulatory & Legal Escalation Status:

Formal fraud and regulatory complaints backed by raw CSV server logs have been filed with:

1. The California Attorney General (Consumer Fraud & Automatic Renewal Law Violation)
2. The Federal Trade Commission (FTC)
3. Stripe Risk & Merchant Compliance (for merchant billing abuse)
4. My Bank’s Fraud Department (Formal Chargeback)

To every US and European developer/company reading this: Do NOT trust Cursor with an uncapped payment method. Use virtual, single-use cards with strict $1 limits—because if their backend glitches, Anysphere will drain your account, override your safety limits, ignore your cancellation, censor your reports, and trap you in an AI bot loop while keeping your money.

@mntruell — Fix your broken billing architecture, refund the $278.25 you stole, void the $80.34 demand, and purge my card immediately.