Cursor Security Reviews: Cloud Data Path Still the Real Blocker

The short version

Cursor has spent 2026 adding the security tooling that buyers have asked for. It shipped review agents, a bot that inspects pull requests, and a deployment monitor. Yet when enterprise security teams evaluate it, the sticking point is usually not a missing feature. It is where the code goes. Cursor cannot be self-hosted, and requests pass through Cursor's own infrastructure regardless of how a customer configures it 2. That architectural fact, more than any capability checklist, is shaping how cautious organizations choose AI coding tools.

What Cursor shipped

Cursor's most visible security move is a "Security Reviewer" bot. It scans every pull request for missing authentication, exposed credentials, and risky dependency changes 3. A companion "Rollouts" bot watches deployments for regressions. Both are available on Teams and Enterprise plans, with availability dated to September 10–23, 2026 3.

The accounts disagree on timing. One comparison credits Cursor with releasing Security Review agents in April 2026, describing it as only beginning to close the gap with GitHub Copilot 1. The September dates may mark a broader rollout or a newer version of the same effort rather than a contradiction. Either way, the direction is consistent: Cursor is pushing automated security checks into its own product.

Cursor presents this as a response to a specific class of failure. It points to credential and authentication mistakes common in "vibe-coded" apps. It contrasts its approach with Lovable, which called for manual pre-deployment reviews after an API key theft involving METR 3. The argument is that the editor should ship the guardrail itself instead of telling users to check their own work 3. That is a fair pitch about where checks belong. It does not address where the data travels.

Copilot's head start

On integrated security, GitHub Copilot still looks more mature. When CodeQL finds a vulnerability, Copilot Autofix can propose a fix with a plain-English explanation attached to the PR. It covers most alert types and often needs no further editing 1. Copilot's agent workflow is also native to GitHub. A team can assign a cloud agent to an issue as it would a human colleague, and the agent researches the repository, writes code, and opens a draft PR 1. Cursor offers similar capabilities, but they require extra setup through automations, webhooks, and MCP server connections 1.

Those are real differences. But they are differences of polish and integration, and Cursor is clearly working to narrow them.

The issue features don't fix

The harder problem is architectural. Cursor cannot be self-hosted 2. Every request, including those that use a customer's own API key, is assembled on Cursor's servers 2. A team that brings its own model credentials still sends its code context through a third party it must separately vet.

An assessment framed around passing security review lays out the alternatives by data path [2]:

• GitHub Copilot Business: runs as a GitHub-operated service. IDE prompts are not retained, other surfaces are kept for 28 days, and there is no training on customer data. It costs $19 per user per month as of September 30, 2026 2.
• Claude Code via Amazon Bedrock or Google Cloud Vertex: keeps inference inside the customer's own cloud tenant. Logging runs through IAM and CloudTrail-style tooling the organization already audits 2.

From that, the assessment recommends Copilot Business as the default and Claude Code routed through the company's own cloud for agentic work 2. It reserves Tabnine or Cline for genuinely air-gapped environments and advises skipping Devin Desktop, the product formerly known as Windsurf 2. That source is openly prescriptive, so its picks should be read as one informed view rather than settled consensus. Still, its central claim about Cursor's request path is the crux of the matter.

The Copilot option has gaps too. Its audit log records settings, not prompts 2. The point is not that Copilot is flawless, but that its data handling fits patterns security teams already know how to assess.

The takeaway

It is tempting to read Cursor's security releases as erasing the enterprise gap. That reading is incomplete. PR scanning and deployment monitoring address what AI-generated code does once it exists. Security reviewers also ask where proprietary source code travels while it is being written, who can see it, and whether that path sits inside an existing audit boundary.

On the first question, Cursor is catching up quickly, though Copilot's CodeQL integration still leads 13. On the second, Cursor's cloud-only design is a structural constraint that feature work cannot fix 2. Until Cursor offers a self-hosted or customer-cloud deployment, regulated and security-conscious buyers are likely to keep favoring tools whose data path they can contain. Teams for whom a vendor-operated service is acceptable will judge Cursor on productivity, where it remains competitive.