Cursor Security Reviewer Targets Risks in AI-Generated Code

What Cursor shipped

Cursor's September updates added two features aimed at the final step before code reaches users. Rollouts and a Security Reviewer are now available on Teams and Enterprise plans. 1 A release tracker summarized the update as "bots for the last mile," meaning automated agents that work at the end of the pipeline rather than in the editor. 2

The public changelog says little about how the Security Reviewer works. What can be said is that Cursor has made review and staged deployment paid team features, built into the same tool that writes the code.

The rest of the release cycle

The security bots arrived alongside several other agent features. Together they show where Cursor is heading.

• Projects (beta). A coordinator agent can follow a Slack channel, run on a schedule, or watch all of a user's pull requests. It then acts on what it sees without waiting for a prompt. Connected to a bug-report channel, it starts delegating work each time a new bug is posted. Projects began rolling out to all users in early September. 1
• Starting without a repo. Cursor now port-forwards a cloud agent's live environment to the browser. Developers can preview the app and use tools like design mode without first setting up a repository. 1
• Remote control from iOS. Local agents can now be controlled from the Cursor iOS app. 1 The feature is on by default except for Enterprise organizations, where an admin has to enable it in the security and identity settings. It does not depend on cloud agents. A "keep this computer awake" setting stops the host machine from sleeping, as long as it is plugged in with the lid open. 2
• Token efficiency. Cursor reworked its agent harness to cut token costs by 7% while keeping quality high. The changes include shorter system prompts, loading tools only when needed, more cache reuse, compressed file reads, and tuned subagent behavior. Cursor said the goal is to support longer agent runs as agents take on bigger tasks. 2

The two sources mostly agree. The release tracker adds operational detail that the official changelog leaves out, mainly the Enterprise opt-in for remote control and the power requirements for the keep-awake setting. 12

Why a security reviewer, and why now

The broader vibe-coding market is pushing toward more automation and fewer human checkpoints. In late September, Lovable said it had added Opus 5.5 and now builds apps in 57% fewer steps. 3 Krea added custom apps to its creative agent, so users can build image and video tools from a single plain-language prompt. 3 LM Studio's Bionic agent gained a shared Excalidraw canvas, where developers sketch architecture and wireframes that the agent reads and edits. 3

Each of these features shortens the path from idea to running software. A shorter path leaves less time for anyone to ask whether the software is safe. A deep-dive in the same news feed pointed to METR's API key theft as a reason to check authentication, credential access, and permissions before deploying a vibe-coded app. 3 That one incident does not establish a wave of breaches. It does show the specific failures that matter most when code is written faster than it is read:

• leaked secrets
• overly broad permissions
• weak authentication

Reading the move

My interpretation is that Cursor is responding to a problem its own roadmap makes worse. Projects lets agents start work from Slack messages and schedules. Remote control lets developers steer agents from a phone. Cloud previews remove the need for a repo. Every one of these reduces how much attention a person gives each change.

Adding automated review and controlled rollouts at the end of that process is a logical counterweight. It also helps sell to cautious enterprise buyers. Cursor's choice to keep remote control off by default for Enterprise orgs points the same way: it treats large customers as the ones who need guardrails. 2

There are reasons for caution.

• Limited availability. The Security Reviewer is only on Teams and Enterprise plans. 1 Solo builders and hobbyists, who are arguably the most likely to ship unreviewed code, are not covered.
• Unknown coverage. The changelog does not say what classes of vulnerability the reviewer detects. Without that, it is unclear whether it would catch credential-handling mistakes like those raised in the METR case. 13
• AI checking AI. Having one AI system review another's output may help, but it is not the same as a human understanding the permissions model.

The broader trend is clear enough. The tools that made it easy to generate software are now competing on whether that software can be trusted once deployed. Cursor's last-mile bots are an early attempt to sell trust as a feature. Whether they work will depend less on the launch and more on what they catch in practice.