Claude Code vs. Cursor: choosing a coding workflow

Editor's note: This is a documentation-led edition. We have not yet run our own hands-on tests of Claude Code or Cursor. What follows rests on official documentation, published pricing and independent studies we read in full, all accessed on 16 October 2026. A tested update will follow.

Claude Code and Cursor now overlap more than their origins suggest. Claude Code began in the terminal but ships extensions for VS Code and JetBrains IDEs, a desktop app and cloud sessions.[1][2][3][4] Cursor began as an editor but now has a command-line agent, cloud agents and a JetBrains route.[5][6]

So the useful question is not which one can edit files and run tests. Both can. It is where each one puts the human checkpoint by default, and whether that matches how your team already reviews code.

This comparison works through six practical differences: where review happens, permission defaults, context, IDE fit, cost model and data terms. It does not judge output quality, because we have not tested it. For the wider field, see our shortlist of AI coding assistants.

What each is for

Claude Code is Anthropic's agent that reads a repository, edits files and runs commands from your terminal or IDE.[4] Cursor is Anysphere's agent-first editor. Its agent searches the codebase, edits files and runs terminal commands from a side panel.[7]

Sources: Anthropic and Cursor documentation and pricing pages cited below.[4][3][8][9][10][11][12][13][14][15][16][17] US list prices, excluding tax.

Where review happens

In Claude Code, review is built into the session. In Manual mode, the VS Code extension shows "a side-by-side comparison of the original and proposed changes" before each edit, and you accept, reject or edit it.[1] In auto mode or "Edit automatically", Claude "edits most files in your workspace without asking", so review moves to git diff, the IDE's diff viewer or checkpoints you can rewind.[1] A /security-review command runs a security pass over the changes on your branch.[4]

In Cursor, review comes after the edit. Its security page is plain about it:

"Changes save immediately to disk. Always use version control so you can revert changes."

— Cursor Docs, Agent Security (2026).[12]

Cursor offsets this with checkpoints, taken automatically "before making significant changes", which restore files but not the conversation.[7] Agent Review runs a code review on local changes, at Quick or Deep depth, and can run after every commit.[18] Bugbot reviews pull requests on Premium and above.[10]

The practical difference is rhythm. A Claude Code team in Manual mode reviews as it goes; a Cursor team, or a Claude Code team in auto mode, reviews in batches. Batch review only works if your branch discipline and test suite are already good.

Permissions and approval defaults

This is where the two differ most, and where defaults have recently changed.

Claude Code starts interactive terminal and VS Code sessions in auto mode from version 2.1.283.[3] In auto mode, "A separate classifier model reviews actions instead of you and blocks the ones it judges unsafe."[4] Reads and working-directory edits run without review; most other actions go to the classifier.[3] It blocks a documented list by default, including force pushes, production deploys, curl | bash and merging unapproved pull requests. But pushing to any branch of the repository you are working in is allowed.[3]

"Auto mode reduces permission prompts but does not guarantee safety."

— Anthropic, Choose a permission mode, Claude Code Docs (2026).[3]

Manual mode asks before most edits, shell commands and network access, and administrators can turn auto mode off.[3] The shell sandbox, which isolates commands from the file system and network, is "off by default" and does not run on native Windows.[17] One subtle risk: limits you state in chat ("don't push") are re-read from the transcript, and "a boundary can be lost if context compaction removes the message that stated it." A deny rule is the hard guarantee.[3]

Cursor lets the agent read files and edit workspace files without approval, except configuration files.[12] "By default, terminal commands need your approval," its security page says; each MCP tool call also needs approval, and agents "cannot make arbitrary network requests with default settings."[12]

Cursor's Run Modes page adds a classifier option. Auto-review runs allowlisted calls, sandboxes shell commands where it can and sends the rest to a model on Cursor's backend.[13] Cursor calls it "the safest useful setup for most people", and the page's changelog says it "shipped as the recommended default" in version 3.6 on 29 May 2026.[13][19] Cursor adds: "The classifier can make mistakes."[13] The pages do not say clearly whether new installs start in Auto-review or with commands asking. Check the setting on your own machines.

AI Chronicle

Our research on what agent platforms disclose about permissions compares these controls across vendors.

Context handling

Neither tool remembers your project between sessions on its own. Each Claude Code session "begins with a fresh context window", and Cursor's docs note that models "don't retain memory between completions."[8][14] Both fill the gap with instruction files.

Claude Code loads CLAUDE.md files at the start of every session, from managed, user, project and local locations. It reads a repository's AGENTS.md instead when no CLAUDE.md exists.[8] It also keeps "auto memory": notes Claude writes about your corrections and preferences, whose index loads each session up to 200 lines or 25KB.[8] Anthropic treats all of these as "context, not enforced configuration", and recommends files under 200 lines.[8] Long sessions are summarised by auto-compaction as they near the context limit.[20]

Cursor uses rules: project rules in .cursor/rules, scoped by file pattern or pulled in when relevant; user rules; team rules that admins can enforce; and AGENTS.md, including nested files.[14] A .cursorignore file blocks agent access to specific files.[12]

The practical gap is smaller than it looks. Both read AGENTS.md, so a team can keep one shared instruction file. Teams that need instructions applied centrally get managed CLAUDE.md files in one tool and enforced team rules in the other.[8][14]

IDE integration

Claude Code meets you in your existing editor. The VS Code extension adds inline diffs, @-mentions with line ranges and plan review. It installs in Cursor and other VS Code-based editors too.[1] The JetBrains plugin, still labelled beta, runs the CLI in the IDE terminal and opens changes in the IDE's diff viewer.[2] The extension sees your selected text and open file; a Read deny rule keeps sensitive files such as .env out.[1]

Cursor asks you to move into its editor, then brings the agent close to the code. Outside it, JetBrains users can install Cursor from the ACP registry inside JetBrains' AI Assistant, on a paid plan.[6] The agent CLI covers terminal and CI use.[5]

If your team is split across editors, Claude Code demands less migration. If most of your team already works in Cursor, its agent is the native option.

Cost model: subscription allowance vs. usage pool

Both sell subscriptions, but what a subscription buys differs.

Claude Code is included in every paid Claude plan and "shares the same usage limits as the rest of your plan".[9] Limits reset on a rolling five-hour window, with weekly caps on paid plans; past them, usage credits bill at standard API rates.[9] Prices on 16 October 2026: Pro $20 a month ($17 billed annually); Max from $100; Team standard seats $25 monthly or $20 annually; Enterprise $20 a seat plus usage at API rates.[9] Anthropic says enterprise deployments average "around $13 per developer per active day" and $150–250 a month. Treat that as a vendor estimate.[20]

Cursor is "sold as part of The X Subscription, one subscription for Grok, Cursor, and X".[11] Paid plans include a weekly usage pool shared across Cursor and Grok.[11] Anthropic, OpenAI and Google models are outside the pool: on Premium and above they cost API list price, paid from prepaid credit.[11] Prices on 16 October 2026: Free; Plus $8 (Grok models only); Premium $30; Super $100; Ultra $200; Teams $30, $100 or $200 a seat.[10][11] Team and Enterprise plans add a Cursor Token Rate of $0.25 per million tokens on third-party models.[11]

The consequence: a team that wants Claude models inside Cursor pays a subscription plus per-token charges. A team that wants a fixed monthly ceiling should check Cursor's monthly additional-usage cap and Claude's spend limits before rollout.[11][20]

Data terms

Claude Code follows the plan you sign in with. On Free, Pro and Max, Anthropic trains on your data "when this setting is on", and keeps it five years, or 30 days if you opt out.[21] On Team, Enterprise and the API, Anthropic does not train on Claude Code prompts or code by default, and standard retention is 30 days.[21] Session transcripts are also stored locally in plain text for 30 days by default.[21]

Cursor turns on Privacy Mode. With it on, code is not used for training and model providers work under zero-data-retention agreements. With it off, Cursor "may use and store codebase data, prompts, editor actions, code snippets" to train its models.[15] Requests route through Cursor's backend even with your own API key.[15] Privacy Mode is on by default for team members, and admins can enforce it; individuals switch it on in settings.[16] Cursor's help page notes that Grok Bot "runs on a separate product surface with its own data flows".[16]

What independent research says

No independent study has compared current versions of these two tools. The closest evidence is METR's early-2025 randomised trial: 16 experienced open-source developers took 19% longer on 246 real issues when AI was allowed, mainly Cursor Pro with Claude 3.5/3.7 Sonnet, though they believed they had been 20% faster.[22] METR now says "These results are out of date."[22] The lasting lesson is to measure review time, not just drafting time.

Documented limits and risks

• Classifiers are not boundaries. Both vendors say their classifiers can let through actions you would block.[3][13]
• Auto-approved edits can execute. Cursor warns that with auto-reload on, "agent changes might execute before you can review them"; Anthropic warns that auto-approved edits can change IDE configuration files that run automatically.[12][1]
• Sandboxes are opt-in or partial. Claude Code's is off by default and absent on native Windows; Cursor's applies to shell commands in its sandboxed modes.[17][13]
• Chat-stated limits are fragile in Claude Code's auto mode after compaction.[3]
• Costs scale with use. Third-party models in Cursor and usage credits in Claude both bill per token.[11][9]
• Cursor's billing bundle includes X and Grok features, which some procurement teams may need to review.[10]

Who it suits, and who should skip it

• Claude Code suits terminal-first developers, teams spread across several editors, and anyone scripting agents into CI with an exact allowlist.[3] Skip auto mode on sensitive repositories until deny rules, ask rules for pushes and the sandbox are set.
• Cursor suits teams that want one editor with the agent, diffs and checkpoints in one place, and a choice of models from several labs. Skip it if X/Grok-bundled billing will not pass procurement, or if you need Claude models without per-token charges on top.
• Either suits a team with strong branch protection and tests. Neither suits unreviewed changes to production code.

How to test it yourself

1. Record the starting permission mode on a fresh install of each: auto or Manual in Claude Code, and the Run Mode in Cursor.
2. Use a throwaway branch with no production credentials, and plant a dummy .env to see what each tool reads.
3. Set one deny rule (for example, no git push) and check it holds when you ask the agent to push.
4. Run the same three defined tasks in both: a failing test, a reproducible bug, a covered refactor.
5. Time the whole job, including your review and rework, against doing it without AI.
6. Count rejected diffs and commands, and note whether you reviewed before or after the change hit disk.
7. Check the data setting on the plan you actually use.
8. Log the cost per task: plan usage, credits or per-token charges.

A worked example (hypothetical)

This scenario is invented to show how the choice works in practice. No tool was run, and no outputs are reported.

Bilal runs a six-person team with a payments API and a customer dashboard. Two backend engineers live in the terminal and maintain CI scripts. Four product engineers work in an editor all day.

The API team uses a terminal agent in Manual mode, with the sandbox on and deny rules for pushes and secrets. Every edit is reviewed before it lands.

The dashboard team uses an agent-first editor, with workspace edits allowed and commands asking. They commit small, rely on checkpoints, and run an AI review before opening a pull request.

Both share one AGENTS.md, so conventions stay identical whichever tool reads them.

Data and cost rules are set once: business plans only, so no training by default, and a monthly spend cap on each.

His test for every change: could a reviewer see what changed and why, and undo it in one step?

Questions readers commonly ask

Can I use Claude Code inside Cursor?

Yes. Anthropic's VS Code extension installs in Cursor, so you can keep Cursor's editor and run Claude Code in its panel or terminal.[1] You would then pay for each product separately.

Which is safer?

Neither, by default. Both let the agent edit files without asking, and both offer a classifier mode they say can make mistakes.[3][12][13] Safety depends on the settings you choose. Our analysis of who is accountable when an AI agent acts covers why a human sign-off still matters.

Can I use Claude models in Cursor?

Yes, on Premium and above, at API list price from prepaid credit, on top of the subscription.[11]

Is either free?

Cursor has a Free plan with limited agent requests.[10] Claude Code needs a paid Claude plan or a Console account.[9][1]

How does this compare with GitHub Copilot?

See our Cursor vs. GitHub Copilot comparison. For each tool in depth, read our Claude Code review and Cursor review.

The next step

Whichever you choose, measure it properly. Our guide to measuring AI productivity without hiding review work shows how to count the review and rework these tools shift onto your team.

Sources and evidence note

Product descriptions, defaults, data terms and prices come from Anthropic's and Cursor's own documentation, pricing and help pages, and describe intended behaviour, not tested performance. Prices are US list prices as displayed on 16 October 2026. Independent evidence comes from METR, read in full on its site. The worked example is invented. All pages were accessed on 16 October 2026.

Related reading

• Cursor vs. GitHub Copilot
• Who is accountable when an AI agent acts?