Cursor sends coding agents into production monitoring

Cursor has launched Rollouts and upgraded Security Reviewer, extending its agents beyond code generation and pull-request review. The tools monitor deployments, investigate regressions, identify vulnerable changes, and propose fixes before problems reach more users.

Both products target the work that follows implementation: checking instrumentation, interpreting latency changes, tracing failures to specific commits, and deciding whether to pause or reverse a release. Cursor is betting that agents can handle these tasks by combining source code, deployment events, and production telemetry.

Rollouts follows code into production

Rollouts tracks a change from the opening of a pull request through its production deployment. Teams connect the agent to source control, deployment pipelines, and observability systems so it can relate code changes to live service behavior.

Before merge, the agent reads the diff and drafts a monitoring plan covering expected effects, potential risks, and gaps in instrumentation. Developers can edit that plan. After deployment, Rollouts compares production signals with a pre-deployment baseline, identifies unexpected changes, points to a suspected commit, and recommends a response.

Teams can configure the agent to take one of several actions:

• Notify the pull-request author
• Pause a gradual rollout
• Prepare a revert pull request for approval

Cursor says Rollouts can detect regressions limited to a single endpoint or region before a broad alert fires. It also uses the monitoring plan to distinguish expected changes from regressions, reducing alerts for deliberate shifts in traffic, latency, or resource use.

Instrumentation checks begin before deployment. If the existing metrics, traces, or logs cannot confirm whether a change works, Rollouts flags the gap during review rather than waiting for a production incident to expose it.

Direct feature-flag control, including automated traffic ramping and rollback, remains on Cursor’s roadmap. The company also plans support for release trains and deployment freezes. The current version can monitor releases, pause supported rollout workflows, notify owners, and draft reverts.

Security Reviewer cuts review time

The updated Security Reviewer runs on each pull request and evaluates changes against the surrounding codebase. Findings include an explanation, severity level, potential attack path, and proposed fix.

Cursor reports that average review time fell from 4.8 minutes to 3.8 minutes, a reduction of about 21%. The company also says developers now accept 60% to 70% of its comments, up from 45% to 50%. That acceptance rate indicates how often teams consider a finding useful enough to act on, although Cursor has not provided sample sizes or an independent evaluation.

Security Reviewer traces how untrusted data enters an application, moves through the code, and reaches sensitive operations. This taint-style analysis can reveal vulnerabilities that depend on application flow, including authorization checks removed during a refactor.

Cursor lists coverage for the following vulnerability classes:

• SQL, command, template, and LDAP injection
• Missing or broken authorization on changed routes
• Secrets committed to source control
• Unsafe deserialization and unvalidated redirects
• Dependencies with known vulnerabilities
• Insecure infrastructure and configuration defaults

A diff becomes the monitoring hypothesis

Rollouts uses each code change to define expected production behavior before deployment. The agent then checks that hypothesis against metrics, traces, and logs. Conditioning the analysis on a specific diff narrows the search space compared with general anomaly detection, which must evaluate every unusual signal without knowing which behavior was intended.

This approach also links ownership and remediation to the same unit of work. When a signal changes, the agent can inspect the relevant pull request, identify its author, evaluate the stated monitoring plan, and prepare a targeted rollback instead of producing an isolated alert.

The practical value will depend on integration quality and telemetry coverage. Rollouts needs access to source control, deployment events, and production observability data. Services with weak instrumentation may gain useful pre-merge warnings, but the agent will have fewer signals for validating a release after deployment.

Plans, access, and trial credits

Rollouts and Security Reviewer are available on Cursor’s Teams and Enterprise plans. Administrators can enable both products from the Automations tab. Rollouts includes usage credits for the first 10 days, allowing teams to test it on production deployments before incurring normal usage costs.

Individual plans do not currently include either tool. Teams already using observability platforms such as Datadog, Grafana, or Honeycomb can connect their existing telemetry and evaluate whether Rollouts produces accurate monitoring plans, useful regression reports, and safe rollback recommendations for their services.