Cursor just shipped a new run mode that tries to fix the most annoying part of working with coding agents: the endless stream of approval prompts. Auto-review sits between the cautious default and the reckless run-everything mode, using a small classifier model to decide what to allow on the fly.

Auto-review is a new run mode that allows Cursor to work for longer with fewer approval prompts and safer execution. It applies to Shell, MCP, and Fetch tool calls. Allowlisted calls run immediately, and calls that can be sandboxed run in the sandbox. Everything else gets handed to a second AI that judges the call in context.

The three-tier gate

The flow is ordered cheapest-to-most-expensive, which matters because every classifier check costs a model round-trip:

1. Allowlist , trusted calls run instantly with no model in the loop.
2. Sandbox , anything that can be safely isolated runs inside Cursor's sandbox automatically.
3. Classifier subagent , all other agent actions go to a classifier subagent that decides whether to allow the call, try a different approach, or ask for your approval.

The classifier is the new piece, and it is not a glorified regex. It is a small reasoning agent embedded in your main agent loop. It reads the proposed action, applies whatever custom instructions you have given it, and decides. That distinction matters: it can evaluate context, not just match strings. An instruction like "never call external domains other than our API" will hold even for URLs you never anticipated.