Cursor review: coding workflow and review effort

Editor's note: This is a documentation-led edition. We have not yet run our own hands-on tests of Cursor. What follows rests on official documentation, published pricing and independent studies we read in full, all accessed on 16 October 2026. A tested update will follow.

Cursor sells speed. The question for anyone who ships code is how much of that speed survives review. Every Cursor feature changes when a person looks at the work: before a line lands, after a whole diff is saved, or only once a pull request arrives.

This review follows that thread: what each part of Cursor does without asking, the controls that move the checkpoint, prices and data terms, and what independent studies found about the review work AI code creates. We give no scores; those wait for our own tests. For how Cursor sits among other tools, see our shortlist of AI coding assistants.

What Cursor is, and what each part is for

Cursor is a desktop code editor from Anysphere, with a web app and a command-line tool. According to its documentation:

• Tab is autocomplete. It suggests code as grey text, can change several lines or add imports, and can jump to the next place, or file, it predicts you will edit. You accept with Tab and reject with Esc.[1]
• Agent reads, searches and edits files in your project and runs terminal commands on your machine. Reading and searching need no approval, and neither do file edits, apart from configuration files.[2]
• Cloud agents, which Cursor used to call Background Agents, run "in isolated VMs in the cloud" with your repository, dependencies and secrets. Each works on a separate branch and pushes for handoff. You can start them from the editor, the web, Slack, Linear or a GitHub comment, and run many in parallel.[3]
• Rules are standing instructions added to the start of the Agent's context: project rules in .cursor/rules, an AGENTS.md file, personal user rules and dashboard-managed team rules.[4] Rules do not affect Tab.
• Agent Review and Bugbot are Cursor's own reviewers. Agent Review checks local changes inside the editor, at Quick or Deep depth.[5] Bugbot reviews pull requests on GitHub, GitLab, Bitbucket, Azure DevOps or Cursor's own Origin hosting. It leaves comments with suggested fixes and can hand a finding to a cloud agent to fix ("Autofix").[6]

Bugbot reads its own rule files, .cursor/BUGBOT.md, not the Agent's project rules.[6] A team that writes standards once has to put them in both places, or the writer and the reviewer will work from different briefs.

Plans and prices (as of 16 October 2026)

Sources: Cursor's pricing page and its Models & Pricing documentation.[7][8] Prices exclude tax.

Three billing points matter for budgeting review work:

• One pool, shared with Grok. Cursor is "sold as part of The X Subscription, one subscription for Grok, Cursor, and X". The weekly usage pool is shared across the editor, cloud agents and the Grok apps.[8] The pricing page lists X perks, such as ad-free scrolling and an X Money interest rate, in the same comparison table. It also says: "Subscriptions are only sold directly through X Subscription Corp."[7]
• Third-party models cost extra. Claude, GPT and Gemini are billed at API list price from prepaid credit, and Teams and Enterprise pay a further $0.25 per million tokens.[8] Cursor's cloud agent page adds that runs are "charged at API pricing for the selected model" and asks you to set a spend limit.[3]
• Reviews are metered. Bugbot moved from a $40-a-seat subscription to usage billing in 2026. Cursor puts "the average Bugbot run" at $1.00 to $1.50, depending on pull-request size.[9]

Where the review work lands

The figure below maps each part of Cursor against the moment a person is next asked to decide. It shows checkpoints as documented, not how well each feature works.

AI Chronicle

Tab keeps the checkpoint tight. Nothing lands until you accept it, so review happens line by line, as you type.

The local Agent moves the checkpoint to the diff. Cursor's security page is explicit:

"Agents can modify workspace files without approval, except for configuration files."

— Cursor Docs, Agent Security (2026).[2]

It adds that "Changes save immediately to disk" and tells users to rely on version control to revert. A warning follows: with auto-reload on, "agent changes might execute before you can review them."[2] In practice, your review is the diff, after the fact.

Cloud agents move it to the pull request. In the cloud, "The agent auto-runs all terminal commands, letting it iterate on tests," and "The agent has internet access by default." Cursor itself flags the data-exfiltration risk from prompt injection.[10] What returns is a branch, a pull request and artifacts: screenshots, videos and logs of how the agent checked its work.[3] Running several in parallel multiplies the pull requests to read.

Bugbot adds a reader, not a gate. Its GitHub check reports neutral when it finds issues, so "Requiring the status alone does not block merges on findings." To block, an organisation must enable fail-on-unresolved where available.[6] Cursor's own claim is that at default effort "80% of bugs identified are resolved by merge time", and that high effort "finds 35% more bugs".[9] Both are vendor figures from internal runs, not independent measures.

The controls that decide how much you check

Cursor documents several dials. Each trades prompts for trust in a filter.

Run modes (local Agent). These set which shell, MCP and fetch calls run without asking:[11]

• Allowlist runs only listed commands; with an empty list, every call asks. Optional sandboxing applies to shell commands.
• Auto-review runs allowlisted calls, sandboxes other shell commands where possible and sends the rest to a classifier model on Cursor's servers. Cursor recommends it and says it shipped "as the recommended default" in May 2026, yet its security overview still says terminal commands need approval by default.[2][11] Check which mode your install shows.
• Run Everything runs every tool call automatically: "You accept the risk and want zero prompts."

On Auto-review, Cursor is plain: "The classifier can make mistakes." It calls run modes "best-effort guardrails rather than a hard security boundary".[11][2]

Sandbox and protections. On macOS and Linux, sandboxed commands can write only inside the workspace, are kept away from paths such as .git/hooks, and reach only allowlisted domains, by default including common package registries.[11] File-deletion and external-file protections can force approval in any mode. A newer "Workspace" read setting asks before the agent reads files outside the project; the default lets it read the whole system.[11]

Other local controls. .cursorignore hides files from the agent. Workspace trust, which prompts before opening an unfamiliar repository, is off by default.[2]

Cloud controls. Network access can be narrowed to "Default + allowlist" or "Allowlist only", per user, per environment or for a team. Only Enterprise can lock it. Secrets can be marked "Runtime" so they are redacted from transcripts and commits.[10] Cloud agents "do not use Run Modes".[11]

Rules and review policy. Rules shape what the agent writes, and team admins can enforce them. Cursor's own caveat: "AI guidance should not be your only security control."[4] Bugbot reads its settings from the base branch, so "a PR cannot change how Bugbot reviews itself."[6]

Data terms

Cursor's data policy (updated 3 September 2026) splits on one setting, Privacy Mode:[12]

• On: code is not used for training by Cursor, and Cursor says it holds zero-data-retention agreements with its model providers. Abuse-detection systems may still store flagged prompts.
• Off: Cursor "may use and store codebase data, prompts, editor actions, code snippets" and more to train its models.

Privacy Mode is on by default for team members, and Teams and Enterprise admins can enforce it.[13] The pages we read do not say whether it is on by default for a new individual account, so check it yourself. Requests pass through Cursor's servers "Even if you use your API key", and zero data retention does not apply to your own keys.[12][13] Cloud agents need the newer Privacy Mode, not the "Legacy" one, because they store code in the cloud while they run. Their conversation history is kept indefinitely by default.[10]

What independent research says about review effort

METR's trial, early 2025: the Cursor study. Sixteen experienced open-source developers worked on 246 real issues in repositories they knew well, each issue randomly allowed or barred from AI. With AI, mainly Cursor Pro with Claude 3.5/3.7 Sonnet, tasks took 19% longer. Developers had expected a 24% speed-up and still believed afterwards that they had been 20% faster.[14] The paper's detail is about review. Developers accepted under 44% of Cursor's generations. On the 44 issues with labelled screen recordings, about 9% of AI-allowed time went on reviewing and cleaning AI output. And 75% said they read every line of AI-generated code.[15]

"developers often spend time reviewing, testing, or modifying AI generated code before they decide to reject it."

— Becker, Rush, Barnes and Rein (METR), Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity (2025).[15]

METR now labels the results "out of date".[14] They describe early-2025 Cursor, not today's agents.

METR's follow-up, February 2026. With 57 developers across 143 repositories, raw estimates pointed to speed-ups: 18% for returning developers and 4% for new ones, with confidence intervals that include a slowdown. METR called the data "an unreliable signal". Some 30% to 50% of developers withheld tasks they did not want to do without AI, and time records were unreliable for those running several agents at once. METR judges developers were likely sped up more by early 2026.[16] That last problem matters for cloud agents: parallel work is hard to time, so it is easy to undercount the review it creates.

Cui and colleagues, field experiments. Across 4,867 developers at Microsoft, Accenture and a Fortune 100 firm using 2022–23 GitHub Copilot autocomplete, completed pull requests rose 26.08% (standard error 10.3%).[17] It is the closest evidence for a Tab-style tool, not for agents. On quality, results split: approval rates rose at Microsoft, but the build success rate fell 17.4% at Accenture. The authors warn that if developers rely on the tool "without review, it could introduce errors or decrease code quality."[17]

None of these studies tested Cursor's current Agent, cloud agents or Bugbot. Our review of workplace AI studies sets them side by side, and our guide to measuring AI productivity without hiding review work shows how to count the checking time.

Documented limits and risks

• Edits land before review. The local Agent saves changes to disk without approval.[2]
• Filters, not boundaries. Cursor calls run modes best-effort and says its classifier can err.[2][11]
• Unattended cloud work. Cloud agents run every command, with internet on by default.[10]
• Non-blocking review. Bugbot findings do not stop a merge unless you configure them to.[6]
• Split rule files. Agent rules and Bugbot rules live in different files.[6]
• Training opt-in by setting. With Privacy Mode off, code and prompts can train Cursor's models.[12]
• Variable costs. Third-party models, cloud runs and Bugbot reviews are metered.[8][3][9]
• Bundled billing. Plans come through X Subscription Corp with X and Grok features attached.[7]

Who it suits, and who should skip it

It suits developers who want AI inside the editor and the option to hand off tasks without changing tools, and teams willing to configure the checkpoints: an allowlist or sandbox locally, restricted egress for cloud agents and a Bugbot check that blocks unresolved findings.

Skip it, or limit it to Tab, if your organisation cannot accept agents that write to disk before approval, or cannot verify Privacy Mode on every account. Skip it too if procurement will not pass a subscription bundled with a social network and Grok, or if you need fixed monthly costs and plan to lean on third-party models and cloud agents.

How to test it yourself

1. Pick three defined tasks with a clear finish line: a failing test, a reproducible bug, a refactor covered by tests.
2. Record the settings first: plan, model, run mode, sandbox, Read Access, Privacy Mode and cloud network mode.
3. Work on a branch or a throwaway clone, with no production credentials in the environment.
4. Time review separately: reading diffs, rerunning tests and fixing AI output, as well as total time per task.
5. Count what you rejected: suggestions, diffs and commands.
6. Run one task as a cloud agent and compare the pull request with what you asked for, line by line.
7. Turn Bugbot on with a required check and log which findings were real, false or missed by a human reviewer.
8. Track the cost per task from the usage dashboard, including third-party model and Bugbot charges.

A worked example (hypothetical)

This scenario is invented to show how the controls fit together. No tool was run, and no outputs are reported.

Priya leads four developers on a booking app hosted on GitHub. Her rule: Cursor can draft anything, but every change must be readable in one sitting.

Locally, the team uses Allowlist mode with sandboxing. Tests and linters are allowlisted; everything else asks. Read Access is set to Workspace, and .cursorignore hides the folder holding staging credentials.

In the cloud, agents get only dependency upgrades and test-coverage chores. Network is set to "Allowlist only" with the package registry added. Secrets are Runtime type.

At review, a .cursor/BUGBOT.md file restates the coding standards from the project rules. Branch protection requires the Bugbot check with fail-on-unresolved on, and a human approves every merge.

Each fortnight, she logs review minutes per merged pull request, following AI Chronicle's measurement guide, and drops any task type where review time outgrows the drafting it saved.

Questions readers commonly ask

Is Cursor safe to use on company code?

It can be, with configuration. Turn Privacy Mode on and, on a team plan, enforce it. Keep the Agent on Allowlist or sandboxed modes, and restrict cloud network access.[12][13][11][10] Our research on what agent platforms disclose about permissions shows what to ask any vendor.

Does Cursor make developers faster?

The evidence is mixed and dated. METR's 2025 trial, which used Cursor, measured a 19% slowdown. Its 2026 follow-up suggests speed-ups but cannot size them reliably.[14][16] Measure on your own tasks, review time included.

Do I still need human code review if I use Bugbot?

Yes. Bugbot comments but does not block merges unless you set it to, and its resolution figures are Cursor's own.[6][9]

How does Cursor compare with GitHub Copilot or Claude Code?

That depends on where you want the agent to run. See our comparisons of Cursor and GitHub Copilot and of Claude Code and Cursor.

The next step

If you are choosing between the two best-known AI editors, read Cursor vs. GitHub Copilot next.

Sources and evidence note

Product descriptions, defaults, prices and data terms come from Cursor's own pricing page, documentation, help centre, data-use page and blog, and describe intended behaviour, not tested performance. Prices are US list prices as displayed on 16 October 2026. Independent evidence comes from METR's 2025 study page and paper, METR's February 2026 update and the author-hosted version of Cui and colleagues' paper, each read in full. The worked example is invented. All pages were accessed on 16 October 2026.

Related reading

• GitHub Copilot review: coding tasks and limitations
• Claude Code review: from task to reviewed change