Cursor rolls out AI security review that hunts for PR vulnerabilities

Cursor is rolling out Cursor Security Review, a new feature that uses AI agents to automatically find security vulnerabilities in pull requests and codebases. It's now available for Teams and Enterprise customers.

The launch comes as AI coding agents become increasingly common — Linear's CEO recently argued they mainly add bandwidth rather than replace engineers.

The feature comes with two permanent AI security agents. The first, called Security Reviewer, looks at every pull request for vulnerabilities and leaves comments. The second, Vulnerability Scanner, periodically scans the entire codebase and sends findings to Slack.

Teams can also customize these agents — adjusting when they trigger, adding custom instructions, connecting proprietary tools, and configuring how outputs are shared. Cursor says it's continuously improving the runtime, test framework, and model capabilities behind Security Review to make the default experience better.