Cursor security: AI editors, agents, and your codebase

What Cursor is

Cursor is a code editor built on the VS Code codebase, with AI features for completion, chat over the codebase, and an agent that can plan changes across files and run commands in the integrated terminal. It supports multiple model providers and MCP servers, and offers team plans with administrative settings.

What Cursor can access

• Your codebase, including files indexed for semantic search, subject to ignore files you configure.
• The terminal, through the agent, which can run commands with the developer's local credentials.
• Model providers, which receive code context to generate responses. Privacy settings affect how code is retained by Cursor and its providers; confirm what your plan's privacy mode commits to.
• MCP servers you connect, with their own credentials and permissions.

Key risks

Auto-run of agent commands

Agent settings can allow commands to run automatically. On a laptop with cloud credentials or production database access, automatic execution means an injected or mistaken command runs with that access.

Rules files and hidden instructions

Project rules files and repository content guide the agent's behavior. Researchers have shown that instructions can be hidden in such files — including with invisible Unicode characters — to steer AI coding assistants. Review rules files like code, and be cautious opening untrusted repositories with agent features enabled.

Privacy settings not enforced

If privacy or retention settings are left to individual developers, some code will be processed under less restrictive terms. Team plans can enforce settings centrally.

Secrets in the workspace

As with any AI coding tool, secrets in files are readable context. Ignore files reduce indexing but are not a substitute for keeping secrets out of the repository.

Recommended controls

• Standardize on a team plan and enforce privacy settings organization-wide.
• Disable automatic command execution, or restrict it to a narrow allow-list of safe commands.
• Add sensitive paths to ignore files, and keep secrets out of repositories entirely.
• Review project rules files in code review; treat them as executable guidance.
• Open untrusted repositories with agent features disabled or in an isolated environment.
• Approve MCP servers centrally and prefer read-only credentials.
• Require human review of AI-generated changes before merge.

How FlashTower assesses this

When you add Cursor to a FlashTower Scan, the Risk Engine evaluates how it is actually used in your organization — account type, data accessed, capabilities, autonomy, credentials, logging, and vendor terms — against a versioned, deterministic ruleset. These rules are the most relevant for Cursor. Each fires only when its stated condition is met. See how scoring works.