Cursor shipped Security Review in beta, available now on Teams and Enterprise plans. The feature adds two always-on AI security agents — Security Reviewer and Vulnerability Scanner — that run continuously against your codebase without manual triggers.
Security Reviewer checks every pull request across five categories: security vulnerabilities, auth regressions, privacy and data-handling risks, agent tool auto-approvals, and prompt injection attacks. That last one is notable — as AI-assisted coding grows, so does the attack surface for prompt injection in codebases that interact with LLMs. Vulnerability Scanner takes a broader approach, scanning your code for known risky patterns and security bugs outside the PR workflow. Both agents run on Cursor’s Automations platform and require Cloud Agents to be enabled.
NOTE
Configuration happens through the Security Review Dashboard, not through settings files. You create and manage agents from there.
The timing makes sense. AI coding tools generate code faster than humans can review it. Cursor is essentially building the safety net for its own acceleration — if the IDE helps you write code at 3x speed, the security review layer needs to keep pace. Shipping this on Teams and Enterprise plans first signals that Cursor sees security tooling as a business-tier differentiator, not a free feature.
For teams already on Cursor’s paid plans, the practical move is straightforward: open the Security Review Dashboard, spin up both agent types, and let them run against your next few PRs. Treat the beta period as a calibration phase — watch for false positives and assess whether the findings surface real issues or noise before building it into your merge requirements.