---
schema: "swft.publication/v1"
id: "company-cursor-agent-factory"
title: "Cursor's agent factory: cloud computers, Bugbot review, and security loops"
description: "How Cursor uses isolated coding agents, computer-use evidence, ensemble code review, and recurring security agents in its own development workflow."
summary: "Cursor gives each cloud coding agent an isolated computer, asks it to test the running product, and returns visual and technical evidence with the code. Separate review and security agents check pull requests and recurring risks. Cursor reports substantial internal use, but the scale and outcome figures are not independently audited."
canonical: "https://swft.io/companies/cursor-agent-factory"
author: "SWFT Editorial"
author_type: "Organization"
published: "2026-09-01"
modified: "2026-09-02"
kind: "case-study"
section: "Companies"
tags: ["Cursor cloud agents", "Cursor Bugbot", "AI code review", "security agents", "agent computer use", "AI software factory"]
evidence_labels: ["OBS", "SELF-REPORT"]
source_ids: ["cursor-agent-computer-use", "cursor-bugbot", "cursor-security-agents", "cursor-security-automation-github"]
authorship_disclosure: "AI-drafted from the cited public sources and independently checked by a second AI editorial-review agent (Codex) for source fit, claim boundaries, overlap, and reader utility. SWFT Editorial is responsible for corrections."
---

# Cursor's agent factory: cloud computers, Bugbot review, and security loops

Cursor combines isolated cloud coding agents, an eight-pass pull-request reviewer, and event-driven security agents with evidence and human escalation paths.

> **Authorship:** AI-drafted from the cited public sources and independently checked by a second AI editorial-review agent (Codex) for source fit, claim boundaries, overlap, and reader utility. SWFT Editorial is responsible for corrections.

## Quick answer

Cursor gives each cloud coding agent an isolated computer, asks it to test the running product, and returns visual and technical evidence with the code. Separate review and security agents check pull requests and recurring risks. Cursor reports substantial internal use, but the scale and outcome figures are not independently audited.

Cursor's public accounts show three connected production lines: cloud agents implement and test changes, Bugbot reviews pull requests, and security agents investigate vulnerabilities and recurring risks. Each line uses a different kind of evidence instead of asking one general agent to do everything.

## Cloud agents receive a complete work computer

Cursor's [February 2026 account](https://cursor.com/blog/agent-computer-use) says each cloud agent runs in an isolated virtual machine with a browser, terminal, development tools, and the target repository. Several agents can work in parallel without sharing a filesystem or process state.

The agent can start the application, reproduce a problem, interact with the interface, and return screenshots, video, logs, and code. These artifacts make the result easier to inspect. A green unit test may show that a function behaves correctly; a recording may show whether the complete interface works as requested.

Cursor reported that more than 30 percent of pull requests merged at Cursor were created autonomously in these cloud sandboxes. The wording matters. It describes the origin of merged pull requests, not the share of all engineering work, the size of those changes, or the amount of human specification and review around them.

## Bugbot uses an ensemble instead of one review pass

Cursor's [Bugbot account](https://cursor.com/blog/building-bugbot) says the reviewer runs on every internal code change. An **ensemble** is a group of model passes whose results are combined. Bugbot runs eight review passes with randomized diff order, asks a validator to check candidate findings, uses majority voting, and removes duplicates before presenting comments.

Cursor says it ran about 40 experiments while developing this design and increased its issue-resolution measure from 52 percent to more than 70 percent. The measure asks whether a finding led to a useful resolution. Cursor uses model-based judgment with human spot checks, so it should not be read as an independent precision or recall score.

The architecture still carries a practical lesson. A first model proposes findings. A separate stage challenges them. Aggregation removes weak or repeated claims. This spends more compute to protect reviewer attention.

## Security agents run at several points in the lifecycle

Cursor's [March 2026 security account](https://cursor.com/blog/security-agents) describes agents reviewing more than 3,000 internal pull requests per week and identifying more than 200 vulnerabilities. The system began in shadow mode with Slack messages, moved to pull-request comments, and later became a blocking gate for selected findings.

Other security agents work on different rhythms. One investigates dependency changes and can reproduce a vulnerability, add a test, prepare a fix, and support a canary rollout. Another runs every day to check security invariants across the codebase. Persistent context, deduplication, and specialist subagents help later runs use what earlier runs learned.

This is closer to a factory than a single coding session because triggers, roles, checks, and handoffs are explicit. A pull request starts one kind of review. A new dependency or a daily schedule starts another. The output can become a finding, a test, a proposed change, or a deployment step under existing controls.

Cursor reports a fivefold increase in pull-request volume over nine months while describing this security expansion. The public account does not isolate whether agents caused that growth, whether task size changed, or how the vulnerability count was defined. More findings can reflect more coverage, more code, or more false positives.

## Part of the security implementation is inspectable

Cursor security engineer Travis McPeak published a [reference repository](https://github.com/mcpeak/cursor-security-automation) for the automation around security agents. It shows an MCP server and Slack notification service. MCP, or Model Context Protocol, is a standard way for an agent to call tools and retrieve context.

The repository explicitly says it is a reference implementation and not production hardened. Cursor's internal service, rules, model configuration, credentials, data, and operational history remain private. The public code helps readers inspect one integration pattern without proving the performance of the production system.

## The evidence remains first-party

Cursor is both the toolmaker and the operator reporting the results. It has not published raw pull-request samples, vulnerability severities, false-positive rates, defect escape rates, or a controlled comparison with teams that did not use the system. Bugbot's resolution metric includes model judgment, and the more than 30 percent figure says nothing about rejected or abandoned agent attempts.

## What a product team can copy

Match evidence to the job. Give implementation agents a runnable application and a way to capture behavior. Use several independent passes for high-value review, then validate and deduplicate their findings. Introduce consequential reviewers in shadow mode before they can block work. Separate pull-request, dependency, and scheduled security jobs, and measure reviewer attention and escaped defects alongside the number of findings.

## How we know

- **First-party report (SELF-REPORT)** Cursor says cloud agents run in isolated virtual machines, test applications with computer use, and created more than 30 percent of pull requests merged at Cursor. Sources: [Cursor agents can now control their own computers](https://cursor.com/blog/agent-computer-use).
- **First-party report (SELF-REPORT)** Cursor describes Bugbot's eight-pass ensemble, validator, voting, deduplication, internal deployment, and company-defined resolution metric. Sources: [Building a better Bugbot](https://cursor.com/blog/building-bugbot).
- **First-party report (SELF-REPORT)** Cursor reports specialist security agents across pull-request, dependency, and scheduled workflows, including more than 3,000 reviews per week and more than 200 identified vulnerabilities. Sources: [Securing our codebase with autonomous agents](https://cursor.com/blog/security-agents).
- **Observed artifact (OBS)** A public reference repository exposes part of Cursor's MCP and notification pattern while warning that the code is not production hardened. Sources: [Cursor security automation reference implementation](https://github.com/mcpeak/cursor-security-automation).

## Sources

- **First-party report (SELF-REPORT)** [Cursor agents can now control their own computers](https://cursor.com/blog/agent-computer-use) — Cursor; published 2026-02-24; accessed 2026-09-01. Cursor's account of isolated cloud-agent environments, parallel work, browser and application verification, artifacts, rebasing, and internal PR share.
- **First-party report (SELF-REPORT)** [Building a better Bugbot](https://cursor.com/blog/building-bugbot) — Cursor; published 2026-01-15; accessed 2026-09-01. Cursor's account of its internal and customer-facing automated review system, feedback loop, and reported resolution-rate experiment.
- **First-party report (SELF-REPORT)** [Securing our codebase with autonomous agents](https://cursor.com/blog/security-agents) — Cursor; published 2026-03-16; accessed 2026-09-01. Cursor's description of event-driven specialist security agents, just-in-time context, blocking CI, canary release, and company-reported findings.
- **Observed artifact (OBS)** [Cursor security automation reference implementation](https://github.com/mcpeak/cursor-security-automation) — Cursor; accessed 2026-09-01. A public reference implementation linked to Cursor's security-agent account; the repository warns that it is not a production-hardened copy of Cursor's internal system.

## Read next

- [Cloudflare's AI engineering stack: a control plane for company-wide agents](/companies/cloudflare-ai-engineering-stack)
- [Stripe Minions: how developer infrastructure became an AI software factory](/companies/stripe-minions)
- [How an AI software factory works](/software-factory-architecture)