Quick Answer
Yes, Cursor's new security automations are worth piloting, but the safe rollout is still review-first, not auto-fix-first.
The important shift happened across three official launches in March 2026, not one isolated announcement:
| Date | Official update | Why it matters |
|---|---|---|
| 2026-03-05 | Cursor Automations launched | Cursor added always-on agents triggered by schedules, GitHub, Slack, Linear, and webhooks. |
| 2026-03-16 | Cursor published four security automation templates | Teams got official blueprints for PR review, dependency remediation, repo scans, and invariant checks. |
| 2026-03-25 | Self-hosted cloud agents became generally available | Regulated teams got a way to keep code, tool execution, and build artifacts inside their own network. |
That combination turns "use Cursor for security" into a real workflow decision. The safe way to start is one repository, review-only outputs, one human triage owner, and one hosting boundary chosen on purpose.
What Changed in March 2026
Cursor is no longer talking about security agents as a vague future direction. It now has:
- an official Automations product
- an official security-agents launch post
- live Marketplace automation templates
- a 2026-04-01 Cursor security page snapshot that explains data handling and privacy mode
- a new self-hosted cloud agent option for stricter environments
That is enough product signal to justify adoption guidance. It is not enough to justify blind trust.
What Cursor Actually Ships Today
The most useful update is that Cursor's internal names and the Marketplace templates now line up closely enough to map into concrete rollout lanes.
| Cursor's blog name | Marketplace template | Default trigger | Default output | Best first use |
|---|---|---|---|---|
| Agentic Security Review | Find vulnerabilities | PR opened, PR pushed | PR comment + Slack + check run status | review new code before merge |
| Vuln Hunter | Scan codebase for vulnerabilities | daily scheduled run | Slack only | find older security debt |
| Anybump | Remediate dependency vulnerabilities | Linear issue created | PR + Slack, but only when confidence is high | patch dependency risk without flooding engineers |
| Invariant Sentinel | Monitor engineering invariants | daily scheduled run | Slack only when state changes | watch for drift and regression |
Two details from the official templates matter more than the headline:
- The PR-review template explicitly says: review the diff, post findings, and do not push code changes or open fix PRs from that workflow.
- The scheduled scan and invariant templates are designed to report only validated issues or state changes, which is exactly what keeps security automation from becoming background noise.
Tip 1: Start With The Review-Only Template That Cursor Already Ships
If you adopt only one template first, use Find vulnerabilities.
That is not just because PR review is familiar. It is because Cursor's own default template already encodes the right safety boundary:
- trigger on PR open and PR push
- comment with prioritized findings
- update the check run status
- do not push changes
- do not open a fix PR from this workflow
That default is a better starting point than custom autonomy. It lets you measure false positives before the agent gets repair authority.
A good first progression looks like this:
- private Slack reporting or PR comments only
- human triage on every non-trivial finding
- dependency-fix PRs for one narrow class of issues
- blocking checks only after the signal is stable
Cursor describes a similar internal progression in its security-agents post: private reporting first, then PR commenting, then a blocking gate.
Tip 2: Keep Four Separate Security Lanes Instead Of One "Security Agent"
Do not collapse PR review, dependency patching, repo-wide scanning, and invariant monitoring into one generic automation.
The official templates already assume different success criteria:
- PR review should be fast and conservative
- repo scanning should trace an end-to-end attack path before reporting
- dependency remediation should open a PR only when the upgrade is clearly safe
- invariant monitoring should alert only on state changes, not every daily re-check
If you merge all of that into one agent, you lose the behavior that makes each lane trustworthy.
Tip 3: Raise The Evidence Bar To Attacker, Input, Path, And Impact
Cursor's own scheduled vulnerability-scan template is stricter than most teams realize. It says every reported issue must include:
- who the attacker is
- what input they control
- how they reach the vulnerable code
- what impact they gain
That is a useful review standard even outside the scheduled scan.
Use a reviewer instruction block like this:
Review this change for validated security issues only.
For every finding, include:
- severity
- attacker model
- attacker-controlled input
- concrete code path from input to impact
- exact files or dependencies involved
- whether this should block merge
Do not report speculative issues, style notes, or best-practice advice without evidence.
If a claim is uncertain, label the uncertainty and say what would validate it.
This does not make the agent correct. It does make the output easier to trust, reject, and audit.
Tip 4: Let Dependency Automation Touch The Smallest Safe Surface First
The Remediate dependency vulnerabilities template is powerful because it already tells the agent to:
- prefer the lowest version that fixes the issue
- review changelogs and breaking changes
- prefer direct upgrades over overrides
- run focused validation on affected code paths
- open a PR only when the upgrade is clearly safe
That is a strong baseline, but the rollout still needs a boundary.
A safer first boundary looks like this:
- direct dependencies first
- patch and minor upgrades first
- exclude major-version jumps in phase one
- require the narrowest package-relevant test command you have
- require one human reviewer on every generated PR
A handoff block like this is usually enough:
Only open a remediation PR when all of these are true:
- the vulnerable package is actually imported or reachable
- the selected fix is the lowest-risk version that resolves the advisory
- the change is not a major-version jump
- focused tests for affected code paths pass
- the PR summary explains remaining manual review risk
Otherwise, post the triage result without opening a PR.
Tip 5: Treat Invariants As Written Repository Rules, Not Security Vibes
The Monitor engineering invariants template includes a warning most teams should keep: replace the defaults with the invariants your team actually cares about most.
Bad invariant:
- authentication should be secure
Useful invariants:
- no route under
/adminmay bypassrequireAdmin - secrets must not be logged to production sinks
- billing side effects must stay behind explicit approval checks
- permission checks must match the real read and write capabilities in code paths that expose data
Cursor's invariant template also asks the agent to keep memory entries per invariant and report only status changes since the previous run. That is a good reason to keep the invariant list short and explicit.
Tip 6: Choose The Hosting Boundary Before You Roll Out The Workflow
This is the biggest operational question, not a side detail.
As of 2026-04-01, Cursor's security page says its infrastructure is primarily hosted on AWS, code data is sent to Cursor's servers to power AI features, and privacy mode can be enabled by anyone and is enforced by default for team members.
For many teams, that is enough to run a pilot. For some teams, it is not.
If your blocker is internal network access, private dependencies and caches, or build artifacts leaving your environment, the newer option is self-hosted cloud agents. In its 2026-03-25 launch post, Cursor says self-hosted agents keep code, tool execution, and build artifacts inside your own network while preserving the same automation and cloud-agent experience. That same post also says inference and planning still run through Cursor, so teams with strict no-code-leaves requirements should review Cursor-hosted data handling separately before rollout.
A simple decision rule works well:
| If your situation is... | Safer first choice |
|---|---|
| public or low-sensitivity repo, standard CI, normal branch protections | Cursor-hosted automation pilot |
| private dependencies, internal network endpoints, or strict artifact-locality controls | self-hosted cloud agents first |
Do not decide this after the automation is already wired into Slack and GitHub.
Tip 7: Measure Success By Remediation And Noise, Not Demo Quality
The real question is not whether the demo looks impressive. The real question is whether the workflow reduces security backlog without creating a second review backlog.
Track a few boring metrics for the first two to four weeks:
| Metric | Why it matters |
|---|---|
| validated findings per week | tells you whether the automation finds real work |
| false-positive rate | predicts whether developers will trust it |
| dependency PRs opened and merged | shows whether remediation is operational, not theoretical |
| time from finding to fix | measures actual security value |
| repeat findings for the same invariant or package | shows whether your feedback loop is weak |
If you see many comments and few merged fixes, the answer is usually to narrow the scope, not to add more autonomy.
A Safe First 14-Day Rollout Plan
If you want one concrete rollout path, use this sequence:
- Turn on Find vulnerabilities for one active repository in report-only mode.
- Define three to five concrete finding categories you care about before the first run.
- Add Remediate dependency vulnerabilities only for patch or minor upgrades with focused tests.
- Write three explicit invariants before enabling Monitor engineering invariants.
- If infrastructure boundaries are the blocker, move the rollout to self-hosted cloud agents before expanding coverage.
- Review signal, false positives, and merged fixes weekly before enabling any blocking gate.
FAQ
Are Cursor's security automations a replacement for SAST or dependency scanners?
No. Cursor's official material positions them as agent workflows around review, validation, remediation, and follow-up. They fit best as a layer around existing scanners, tickets, and branch protections.
Which template should most teams try first?
Start with Find vulnerabilities. It is the cleanest review-only entry point and already forbids automatic code changes in the default template.
When should you choose self-hosted cloud agents instead of Cursor-hosted ones?
Choose self-hosted first when your code, build outputs, caches, or internal endpoints cannot leave your environment, or when the agent needs to run against private infrastructure that a Cursor-hosted environment should not reach.
When should you avoid this workflow entirely?
Avoid a broad rollout if the repository has weak tests, weak branch protections, unclear ownership, or no one available to triage findings. In that situation, automation usually creates more queueing, not more security.
Verification Note
Verified on 2026-04-01 using official Cursor sources:
- Build agents that run automatically for the March 5, 2026 Automations launch, triggers, cloud sandboxes, memory, and automation architecture.
- Securing our codebase with autonomous agents for the March 16, 2026 release of Agentic Security Review, Vuln Hunter, Anybump, and Invariant Sentinel, plus Cursor's own rollout sequence.
- Run cloud agents in your own infrastructure for the March 25, 2026 self-hosted GA launch and the claim that code, tool execution, and build artifacts can stay inside your network.
- Cursor Security for current privacy mode and infrastructure statements.
- Find vulnerabilities, Scan codebase for vulnerabilities, Remediate dependency vulnerabilities, and Monitor engineering invariants for the current default triggers, evidence rules, and output behavior in the Marketplace templates.