Agent Reputation & TrustClearinghouse

Cursor agent

Category
Coding agent
Type
Coding agent from Anysphere inside the Cursor editor (agent mode), as background or cloud agents that open pull requests, and as a command-line agent; proprietary; runs models chosen by the user or by Cursor (including Cursor's own Composer models)
Source
Product documentation
Last reviewed
2026-10-19 (what this means)

Citation check incomplete — recheck later.

Summary

Cursor's agent works inside the Cursor editor, as cloud agents that open pull requests, and from the command line. Nineteen independent sources were counted (ten peer-reviewed). Fourteen are field studies of public GitHub pull requests from 2025, mostly drawn from one dataset (AIDev): Cursor acceptance was usually second or third of five agents (about 64-77%), lower for performance fixes (42%), and CI runs on its pull requests failed more often than for Copilot or Codex. In benchmarks, Cursor v2.3 tied the highest result on an iOS benchmark (12%) and Cursor Agent ranked first on one GPU-kernel task set. Security tests found prompt-injection and misuse exposure, reduced in newer versions. 28 CVEs (2025-2026) concern agent features; fixes are listed. Informational only; not a guarantee, endorsement, or certification.

Overall score: 57 · Evidence grade: A · Independent sources: 19 performance (10 peer-reviewed), 17 other

Evidence grade describes the amount and type of evidence, not the agent's quality.

Grade note: Grade A: 19 counted sources (10 peer-reviewed), including versioned tests within 12 months (Cursor v3.3.30 in an ISSTA 2026 study; Cursor v2.3 in a KDD 2026 benchmark). Fourteen counted sources are field studies largely drawn from one dataset (AIDev, 2025), so they are not independent samples. (see methodology)

Factor breakdown

Factor breakdown
FactorWeightScoreNote
Completion rate30%55Pull-request field studies (2025): Cursor acceptance 74.5% (74.4% in the common window, second to Codex 79.9%), 74.6%, 76.47% for security work, 68.4% for fixes, 65.22%, 63.9% estimated, 0.67 average, 51.4%, and 42% for performance fixes; CI runs on its pull requests succeeded 65-73% (Copilot and Codex about 93%). Benchmarks: SWE-Bench Mobile 12% with Cursor v2.3 (tied highest of 22 configurations; low in absolute terms); AgentKernelArena first on Triton-to-Triton with Opus 4.7. Results depend strongly on the model chosen.
Disputes20%4528 CVEs (2025-2026) concern agent features, CVSS 4.4-9.8 (four at 9.6 or above, including 2026 sandbox escapes); all were published by Cursor through GitHub advisories with fixed versions. In July 2025 Cursor apologised for a June 2025 pricing change and offered refunds. No filed legal or regulatory action specific to the agent was found.
Adherence to limits25%40Security tests: malicious issue requests succeeded in 66.5% of runs in auto-run mode (41.1% with Sonnet 4.6); Cursor IDE completed 39.19% of attack-technique misuse requests (Cursor CLI 62.16%); tool-hijacking reached code execution on older releases but at most 0.3 on v3.3.30. Several CVEs are allowlist, sensitive-file or sandbox bypasses, since fixed. One reported incident (2026) of a destructive database deletion. Field data show low security-smell rates in two studies and near-average in another.
Evidence quality25%85Nineteen independent sources, ten peer-reviewed (seven MSR 2026 papers, Information and Software Technology, ISSTA 2026, KDD 2026), with versioned tests within 12 months. Fourteen are field studies largely from one dataset (AIDev, 2025), so they are correlated; benchmarks are few and model-dependent. Grade A.

0.30 × 55 + 0.20 × 45 + 0.25 × 40 + 0.25 × 85 = 56.75, rounded to 57 (rounding rule).

Scope

Cursor's agent features from January 2025: agent mode in the editor, background and cloud agents (pull requests on cursor/ branches), and the Cursor CLI agent. Tab completion, inline edits (Cmd-K), chat-only use, Bugbot code review, the 2024 Composer before agent mode, and whole-product adoption studies are not covered. Results depend heavily on the language model chosen and on the task.

How sources were counted

Anysphere material (blog posts, documentation, CursorBench and the Composer 2 Technical Report) is not counted. Pull-request field studies of Cursor's background and cloud agents count; fourteen of the counted sources are field studies drawn largely from one shared dataset (AIDev, 2025), so they are not independent samples, and, as for the other coding-agent entries, each study counts once. Comparisons written by authors from a competing product's company that include that product are listed but not counted. Studies of Tab completion, of models in a Cursor-like harness, or of whole-product adoption are not evidence about this entry.

Security and disputes

The agent can edit files and run terminal commands, with an optional auto-run mode. 28 CVEs published in 2025 and 2026 concern its agent features (MCP configuration, the auto-run allowlist, sensitive-file protection, the terminal sandbox, the CLI and the cloud agent), with CVSS scores from 4.4 to 9.8; Cursor published each through its GitHub security advisories with a fixed version. In July 2025 Cursor apologised for a June 2025 pricing change and offered refunds for unexpected charges. One self-reported incident (April 2026) describes a Cursor agent deleting a production database volume. No filed legal or regulatory action specific to the agent was found.

Uncertainties

Sources

Independent performance sources (counted)

Other sources (not counted)

Not counted

Decision record: 0083.