roobriefIT news for developers

Dev & Releases

Cursor Agent Commands Can Run on Company Machines, but Vulnerability Checks Run in the Cursor Cloud

Cloud Agent tool calls can stay on company machines, but the file contents the model reads to produce answers do not stay inside the company by default.

Cursor opened two enterprise features in September. On Sept. 2 it announced Self-Hosted Machines, which move file edits and command runs for cloud AI agents (programs that carry out multi-step tasks for you on their own) onto computers the company owns. On Sept. 23 it opened Security Review on Teams and Enterprise plans. Security Review looks for exploitable bugs in pull requests (a proposed code change for someone else to review before it is merged).

Design Mode, which lets you click on-screen elements to fix them, and Agent Tabs, which show several chats side by side in the editor, were not part of those September launches. Design Mode first appeared with Cursor 3 on April 2, and multi-select plus voice notes were added June 5. Agent Tabs are also in the April 2 Cursor 3 changelog.

Point at on-screen elements and hand them to the agent

Design Mode runs in the browser inside the Agents Window, not in a normal web browser. On Mac, turn it on and off with Cmd+Shift+D. The docs do not list a Windows shortcut.

Click one element and that element plus the code behind it go to the agent. From June 5 you can select several elements and say something like “make this match that,” or speak the next edit. The mic stays open while agents work. If you circle a region, the mark sits on a frozen frame of the page, so the agent works from the scene you saw.

Two things are sent for a selected element: where it is on the page and which component it is (path, component name, attributes, computed styles, props), and a screenshot of the surrounding layout. When edits finish, the app redraws without a full reload. Cursor recommends its Composer 2.5 model for this flow.

The multi-agent window and editor tabs are different

The Agents Window is a separate screen that became generally available April 2. In the editor, press Cmd+Shift+P and choose Open Agents Window. You can see local, cloud, and remote SSH (working by connecting to another computer) agents in one place, and run several cloud agents in parallel. To return to the older editor, choose Open IDE from the same list. For two weeks after launch, Enterprise admins could limit who got the window; that window has closed.

Agent Tabs in the editor are in the same changelog but do a different job: they show several chats side by side or in a grid. The screen for running many cloud jobs at once is the Agents Window.

Commands on company machines, decisions in the Cursor cloud

The Sept. 2 changelog summarizes Self-Hosted Machines as keeping tool execution on the company network, with the codebase (all the code in the repository), build outputs, and secrets staying on internal machines.

Cursor’s Self-Hosted Machines docs keep planning in the Cursor cloud. File edits, terminal commands, screen clicks, and local MCP (a standard that lets AI use outside tools) servers run on a worker—the machine that accepts and runs the work. Deciding what to do and inference (using a finished model to produce answers) stay with Cursor.

During a run the worker sends Cursor the file contents it needs, terminal output, diffs, screenshots, local MCP results, and routing metadata. If desktop sharing is on, that desktop stream leaves too. Screenshots, videos, and log references meant for pull requests and the dashboard also upload to Cursor-managed storage. What stays on company machines is the full repository, the build cache (intermediate files kept so they are not rebuilt), and credentials on that machine. The docs say not to put secrets in tool output or artifacts.

With Privacy Mode on, Cursor and model providers do not train on code the worker sends. That does not mean the code never leaves. Workers need no inbound ports—only an outbound encrypted web connection to Cursor. To block only artifacts, block outbound traffic to cloud-agent-artifacts.s3.us-east-1.amazonaws.com. Work continues; artifacts just will not show up on pull requests or the dashboard.

There are two ways to run it:

  • My Machines is personal. You connect your own computer to your account with a browser login or a personal API key (a secret string a program presents instead of a login). Several agents can run on one machine. Dashboard secrets are not pushed to this worker.
  • Team Pools collect workers for an organization. Cursor’s docs require an Enterprise plan. Authentication is a service-account API key only. A service account belongs to the team, not one person. If admins allow opt-in, users can choose per request; otherwise runs use Cursor’s infrastructure. If they require self-hosting, every Cloud Agent run goes to your workers. In a pool, one agent claims one machine at a time.

Environments listed in the Sept. 2 changelog include AWS Lambda, Coder, Cloudflare, Daytona, Modal, Namespace, Vercel, and E2B. The docs also mention Kubernetes (an open-source system for running and managing many containers). Limits are 200 workers per user and 1,000 per team. Model pricing stays the same; the company pays for the machines. Cursor-managed agents include the execution machine.

The docs recommend managed Cloud Agents for most teams. Use self-hosting when code must not leave the network, or when you need GPUs or Macs for iPhone and iPad apps. If the only issue is a private Git server or an internal package registry, docs say try a private link into the company network on managed agents first. Examples are AWS PrivateLink and Cloudflare Tunnel.

Finding exploitable bugs in proposed changes

Security Review opened Sept. 23 on Teams and Enterprise. Pick repositories in the dashboard and it reads non-draft pull requests in codebase context, then posts one review comment on exploitable bugs. Style and quality stay with Bugbot. It does not merge or rewrite the code on its own.

This check does not run on company machines. Security Agents docs say Security Review and repository vulnerability scans run on Cloud Agents and use the Cursor cloud with no extra setup. A Cloud Agent clones the allowed repository into a virtual machine in the Cursor cloud. That clone is not deleted the moment the run ends; snapshots are removed after 30 days of inactivity. One exception: a team’s Security Review triggered by a pull request event runs on Cursor-managed hosting rather than a Cloud Agent. That path is still not a company machine. Whether that host clones the full repository is not stated in those docs.

The scope includes injection into database queries, shell commands, and page templates; missing login or permission checks, including checks that stop running after a refactor; secrets committed to source; SSRF (a bug where a server sends a request to an address an attacker chose) and unvalidated redirects; unsafe deserialization when saved data is turned back into program values; dependency changes that bring known vulnerabilities; and tracing where user input enters and what it passes through.

Each finding has a severity, an attack path, and a proposed fix. Dismiss with a reason and it will not raise the same issue again on that pull request. Team rules apply on every pull request—for example, external calls must go through a fixed client, or certain tables must not be queried from request handlers. Separate pricing is not in this announcement.

The same day, Rollouts also opened on Teams and Enterprise. As a change deploys, it reports per environment whether things look healthy, worse than before, or inconclusive. It does not merge or roll back on its own; depending on settings it can open a revert pull request for review or hand a fix to a cloud agent. Source control connects to Origin or GitHub, and signals to Datadog and similar tools. Feature-flag integration (switches that turn features on or off per user) is only described as coming soon; we could not confirm whether it had shipped by Oct. 16. Trial credits for Rollouts ran for 10 days from launch—about 50 changes for Teams and about 500 for Enterprise. By Oct. 16 that window had closed; we could not confirm whether credits remained afterward.

What we could not confirm, or should treat with care

  • Treating these features as one large update is wrong. On-screen pointing is from April 2 and June 5, self-hosting from Sept. 2, and Security Review from Sept. 23.
  • “Code and build outputs never leave” is broader than Cursor’s docs. The full repository, build cache, and on-machine credentials stay; file contents needed for the run and artifacts go to Cursor.
  • Saying self-hosting opened on Teams and Enterprise together does not match Cursor’s docs. Team Pools require Enterprise. The Sept. 2 changelog only calls pools a queue for teams or enterprises, so Teams plan coverage cannot be confirmed from that sentence alone.
  • That security-focused enterprise customers are adopting faster has no figure or official announcement we could verify.
  • Claims that Security Review blocks every vulnerability or fixes bugs on its own are also absent from Cursor’s announcement.

What could change for developers

What follows is our estimate and advice based on the reports.

  • Do not write “code never leaves” in a security review. Split what stays and what leaves using Cursor’s docs. Treat artifact uploads as a separate question of whether outbound traffic to that storage host is blocked.
  • Team Pools need an Enterprise plan and machine operating costs. Model pricing is unchanged. Trying on your own computer is My Machines. Docs still recommend Cursor-managed Cloud Agents for most teams.
  • Security Review does not run on company machines. Enable it per repository; draft pull requests are skipped. Dismissed findings will not return on that pull request, so leave a reason before dismissing. Style and quality stay with Bugbot.
  • Design Mode is invisible if you only open the editor. Turn it on with Cmd+Shift+D in the Agents Window browser. Shortcut tables in the docs are Mac-only.

What to watch

Whether feature flags connect to Rollouts, whether Security Review pricing and false-positive rates are published, and whether a mode appears that keeps even inference file contents inside the company.

Sources

Source: cursor.com

← Back