A study of 12,110 .cursorrules files finds adoption concentrated in single-maintainer toy projects, with security guidance rare.

First large empirical study of static prompt-configuration files, across 11,427 repos, plus qualitative coding of 65 sampled files into a 65-code codebook (arXiv 2608.10622). Adoption emerged fast from mid-2024 but clusters in small, low-activity, single-maintainer repos. Content is dominated by code quality, engineering practices, project structure, maintainability. Security shows up notably less. Thematic continuity holds between legacy .cursorrules and the current .mdc standard. Cross-reference with the personalized-skills result above and a picture forms: people write a lot of agent config, mostly about style, mostly alone, and we have very little evidence about which parts work.