Anysphere · editor
Cursor: Remove Watermarks from AI Edits
Cursor inverts the usual risk. Most tools are dangerous because code takes a long, lossy route through a browser before reaching your file, whereas Cursor's agent writes to the file directly, which is the shortest route there is. The problem is that the shortest route is also the one with no human inspection step in it, and a diff view shows an watermark as nothing at all.
Scan your Cursor code now
Free, and it reports every removal by codepoint and line.
What we measured
68
code-generation calls
17
provider and model targets
59,486
characters generated
0
contained a hidden character
On 2026-08-12 we sent identical code-writing prompts to every model our own gateway can reach and scanned each raw API response. Not one of them contained a zero-width character, a bidirectional control, or a tag character.
3 of the 68 answers contained typographic punctuation, and only in the prose-heavy prompts rather than in the plain code one. The most common was the non-breaking hyphen, which is visible but still breaks a copied command. 2 left trailing whitespace.
The useful conclusion is the boring one: raw model output is essentially clean, so when you do find hidden characters in your file, they almost certainly came from the path the text travelled rather than from the model. That is what the section below is about.
Scope: this measured API output from models we can reach directly. It did not measure the Cursor web app, which is the point being made, since the browser is where the characters get added.
How code gets out of Cursor, and what each path adds
The model's output goes to disk through the editor's apply mechanism with no HTML rendering anywhere in the chain, so nothing is added in transport. The exposure is review, not transport: no clipboard, no visual pass over the raw text, and a diff renders a zero-width joiner or a tag-block sequence as empty space. Whatever codepoints were generated are now committed unless something scans for them.
The sidebar is a webview rendering markdown into a DOM, the same as any Electron chat surface. A drag selection copies the painted text, which can carry no-break spaces, typographic quotes and dashes, and soft hyphens from layout. The code block copy button reads the source string and avoids that class of problem.
A command line is executed, not reviewed by a compiler, so an watermark in it has an immediate effect. Bidirectional controls can reorder how a command displays without changing what runs, and a zero-width character can silently break or alter an argument. Bracketed paste and terminal wrapping add their own handling on top.
Completions are inserted into the buffer as plain strings with no rendering layer, so this is the cleanest of Cursor's paths. It is also small in volume, which makes anything odd in it easier to spot in a normal read-through.
Two things are specific to an editor with a full agent loop. First, code reaches disk without ever entering a clipboard, so the informal inspection everyone does while pasting simply does not happen, and the check has to be an explicit scan instead of a habit. Second, Cursor's own configuration is text: rules files, docs you have indexed, and repository context are all strings that get assembled into prompts, so a tag-block sequence sitting in a rules file (the block that decodes back to readable ASCII) is invisible in your editor but present in every request. Scan the rules and context files once, not only the generated output.
What this does not do
It does not remove statistical watermarking. Schemes of the SynthID family add no characters at all: they bias which token the model samples, so the signal lives in word choice across the whole output and nothing you can delete carries it. Attacking that means rewriting the text, which for source code risks changing what it does.
This is a hygiene and security tool, not an attribution bypass. Formatters already normalise surface signals, and what identifies generated code is structure and style rather than hidden bytes. Disclose AI assistance wherever you are asked to.
Cursor questions
Cursor writes to my files directly. Doesn't that mean the text is clean? +
It means nothing was added in transit, which is genuinely better than a browser round trip. It does not mean the string is clean. Whatever the model produced is now on disk, and unlike a paste there was no moment where a person looked at the raw characters.
Why does the diff look fine when there is a hidden character in it? +
Because a diff view is a renderer and watermarks render as nothing. Zero-width spaces and joiners, variation selectors and tag-block codepoints occupy no visual width, and bidirectional controls change the display order of a line rather than announcing themselves. You need a scan that reports by codepoint and line number, not a visual read.
Can a rules or context file carry watermarks into every prompt? +
Yes, mechanically. Rules files, indexed documentation and pulled-in repository context are ordinary text that gets concatenated into the request. A tag-block sequence there decodes back into readable instructions for a model while showing nothing to you, which is why those files are worth scanning even though you rarely edit them.
Do the terminal commands Cursor proposes need checking too? +
They deserve more care than file edits, not less. A command runs immediately, and a bidirectional control character can make the visible order of a line differ from the executed order. Scan any command you did not type yourself before you let it run, particularly if it came out of retrieved or pasted text.