Cursor open-sources security agent blueprints — reviewing 3,000+ PRs/week, catching 200+ vulnerabilities

Cursor published detailed blueprints for four security automation agents it runs internally, along with the supporting MCP code, as open templates for other security teams. The four agents: Agentic Security Review (runs on every PR, now blocking CI), Vuln Hunter (scans the existing codebase for vulnerabilities), Anybump (automates dependency patching — runs reachability analysis, traces code paths, runs tests, opens PRs automatically), and Invariant Sentinel (daily drift detection against security and compliance properties). Cursor's security agents are currently reviewing more than 3,000 internal PRs per week and have caught over 200 vulnerabilities. The supporting security MCP is deployed as a serverless Lambda function.

Security is the highest-friction AI adoption category in enterprise. CISOs have blocked AI coding tools in many organizations on the grounds that they introduce vulnerabilities faster than security reviews can catch them. Cursor is directly addressing that objection with production evidence: their own codebase, their own agents, 3,000 PRs/week, 200+ vulnerabilities caught.