Cursor's public accounts show three connected production lines: cloud agents implement and test changes, Bugbot reviews pull requests, and security agents investigate vulnerabilities and recurring risks. Each line uses a different kind of evidence instead of asking one general agent to do everything.
Cloud agents receive a complete work computer
Cursor's February 2026 account says each cloud agent runs in an isolated virtual machine with a browser, terminal, development tools, and the target repository. Several agents can work in parallel without sharing a filesystem or process state.
The agent can start the application, reproduce a problem, interact with the interface, and return screenshots, video, logs, and code. These artifacts make the result easier to inspect. A green unit test may show that a function behaves correctly; a recording may show whether the complete interface works as requested.
Cursor reported that more than 30 percent of pull requests merged at Cursor were created autonomously in these cloud sandboxes. The wording matters. It describes the origin of merged pull requests, not the share of all engineering work, the size of those changes, or the amount of human specification and review around them.
Bugbot uses an ensemble instead of one review pass
Cursor's Bugbot account says the reviewer runs on every internal code change. An ensemble is a group of model passes whose results are combined. Bugbot runs eight review passes with randomized diff order, asks a validator to check candidate findings, uses majority voting, and removes duplicates before presenting comments.
Cursor says it ran about 40 experiments while developing this design and increased its issue-resolution measure from 52 percent to more than 70 percent. The measure asks whether a finding led to a useful resolution. Cursor uses model-based judgment with human spot checks, so it should not be read as an independent precision or recall score.
The architecture still carries a practical lesson. A first model proposes findings. A separate stage challenges them. Aggregation removes weak or repeated claims. This spends more compute to protect reviewer attention.
Security agents run at several points in the lifecycle
Cursor's March 2026 security account describes agents reviewing more than 3,000 internal pull requests per week and identifying more than 200 vulnerabilities. The system began in shadow mode with Slack messages, moved to pull-request comments, and later became a blocking gate for selected findings.
Other security agents work on different rhythms. One investigates dependency changes and can reproduce a vulnerability, add a test, prepare a fix, and support a canary rollout. Another runs every day to check security invariants across the codebase. Persistent context, deduplication, and specialist subagents help later runs use what earlier runs learned.
This is closer to a factory than a single coding session because triggers, roles, checks, and handoffs are explicit. A pull request starts one kind of review. A new dependency or a daily schedule starts another. The output can become a finding, a test, a proposed change, or a deployment step under existing controls.
Cursor reports a fivefold increase in pull-request volume over nine months while describing this security expansion. The public account does not isolate whether agents caused that growth, whether task size changed, or how the vulnerability count was defined. More findings can reflect more coverage, more code, or more false positives.
Part of the security implementation is inspectable
Cursor security engineer Travis McPeak published a reference repository for the automation around security agents. It shows an MCP server and Slack notification service. MCP, or Model Context Protocol, is a standard way for an agent to call tools and retrieve context.
The repository explicitly says it is a reference implementation and not production hardened. Cursor's internal service, rules, model configuration, credentials, data, and operational history remain private. The public code helps readers inspect one integration pattern without proving the performance of the production system.
The evidence remains first-party
Cursor is both the toolmaker and the operator reporting the results. It has not published raw pull-request samples, vulnerability severities, false-positive rates, defect escape rates, or a controlled comparison with teams that did not use the system. Bugbot's resolution metric includes model judgment, and the more than 30 percent figure says nothing about rejected or abandoned agent attempts.
What a product team can copy
Match evidence to the job. Give implementation agents a runnable application and a way to capture behavior. Use several independent passes for high-value review, then validate and deduplicate their findings. Introduce consequential reviewers in shadow mode before they can block work. Separate pull-request, dependency, and scheduled security jobs, and measure reviewer attention and escaped defects alongside the number of findings.