Cursor's Auto-Review Cuts Agent Approval Prompts by 84% Using AI

Cursor just shipped a new run mode that tries to fix the most annoying part of working with coding agents: the endless stream of approval prompts. Auto-review sits between the cautious default and the reckless run-everything mode, using a small classifier model to decide what to allow on the fly.

Auto-review is a new run mode that allows Cursor to work for longer with fewer approval prompts and safer execution. It applies to Shell, MCP, and Fetch tool calls. Allowlisted calls run immediately, and calls that can be sandboxed run in the sandbox. Everything else gets handed to a second AI that judges the call in context.

The three-tier gate

The flow is ordered cheapest-to-most-expensive, which matters because every classifier check costs a model round-trip:

1. Allowlist , trusted calls run instantly with no model in the loop.
2. Sandbox , anything that can be safely isolated runs inside Cursor's sandbox automatically.
3. Classifier subagent , all other agent actions go to a classifier subagent that decides whether to allow the call, try a different approach, or ask for your approval.

The classifier is the new piece, and it is not a glorified regex. It is a small reasoning agent embedded in your main agent loop. It reads the proposed action, applies whatever custom instructions you have given it, and decides. That distinction matters: it can evaluate context, not just match strings. An instruction like "never call external domains other than our API" will hold even for URLs you never anticipated.

How to turn it on

Flip it on under Settings > Cursor Settings > Agents > Run Mode. The same panel lets you write natural-language instructions to steer the classifier. According to the Agent Security docs, on Cursor 3.6 and above, Auto-review is the recommended default. It runs allowlisted calls, sandboxes what it can, and sends anything else through an LLM classifier that decides allow or block based on safety and how well the call matches your intent.

For team-wide rules, you can commit a .cursor/permissions.json file to your repo. It uses allow_instructions and block_instructions fields, so your project rules drive the classifier. Example:

{
  "autoRun": {
    "allow_instructions": [
      "Allow read-only git commands",
      "Allow pnpm test and pnpm lint"
    ],
    "block_instructions": [
      "Never curl external domains",
      "Never touch ~/.ssh or ~/.aws"
    ]
  }
}

What it is good at, and where it breaks down

Auto-review is well-suited to long iterative loops, build-and-test cycles, multi-step refactors with MCP tools, and any workflow where the previous choice was either babysitting a prompt or unleashing YOLO mode on a machine with real credentials. The classifier is good at applying intent: a single rule can cover an entire class of behavior without you enumerating every command.

The catch is that Cursor itself is blunt about the limits. The classifier is non-deterministic and "best-effort convenience, not a security boundary." All four run modes are best-effort; bypasses are possible. If you need hard guarantees, the official recommendation is to stick with an explicit allowlist plus manual approval. There is also the cost-of-thinking concern, which is why the architecture only calls the classifier as a last resort.

Why this matters

The pattern across coding agents this cycle is unmistakable: bounded autonomy. Claude Code uses step-level approval gates, OpenAI's Codex CLI added named permission profiles, and Cline has its auto-approve list. Cursor's contribution is the most autonomous of the bunch because it reasons about each action instead of matching against a fixed policy. The bet is that a small classifier with good instructions beats an ever-growing list of regexes.

There is also a sandboxing story underneath. Cursor previously added OS-level isolation via macOS Seatbelt and Linux bubblewrap, which they state reduced permission prompts by about 84%. Auto-review layers the classifier on top of that for the calls sandboxing cannot handle, such as fetches that must hit your real network or MCP tools that need credentials.

One nice detail from the forum: there is no additional cost for using existing agents when the classifier runs, so the upgrade is essentially free if you are already on a paid plan. For most workflows on a dev machine with real secrets, Auto-review is the sweet spot between safe and usable, as long as you treat it as a productivity feature rather than a wall against malicious prompts hidden in fetched content.