Cursor released Rollouts and Security Review for Teams and Enterprise plans. Rollouts derives a monitoring plan from a pull-request diff, compares production telemetry with a pre-deploy baseline, and can notify, pause a progressive rollout or prepare a revert pull request under policy. Security Review inspects every pull request in whole-codebase context for injection, authorization errors, secrets, unsafe deserialization, redirects, vulnerable dependencies and insecure configuration. Findings include severity, attack path and a proposed fix.
Cursor extends coding agents into deployment monitoring and security review
2026-09-23Verified announcementTRIAL
Cursor released Rollouts and Security Review for Teams and Enterprise plans. Rollouts derives a monitoring plan from a pull-request diff, compares production telemetry with a pre-deploy baseline, and can notify, pause a progressive rollout or prepare a revert pull request under policy. Security Review inspects every pull request in whole-codebase context for injection, authorization errors, secrets, unsafe deserialization, redirects, vulnerable dependencies and insecure configuration. Findings include severity, attack path and a proposed fix.
Availability: Teams and Enterprise
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
For teams using coding agents, the operational boundary now extends beyond merge. The same system can watch production signals and prepare remediation, which shortens feedback loops but also gives it influence over deployment. Trial with notify-only policies first, require human approval for pause or revert, and measure false positives before widening authority.
Evidence & related material
Technical details & scores
| Rollouts | PR-derived monitoring plan; pre/post baseline comparison; notify, pause rollout or prepare revert PR |
|---|---|
| Integrations | Datadog, Grafana and Honeycomb among supported deployment and telemetry systems |
| Security Review | whole-codebase PR analysis with severity, attack path and proposed fix |
| Availability | Teams and Enterprise |
| Evidence Limit | detection quality and production outcomes are vendor-reported |
Technical impact 4
Engineering value 5
Adoption signal 3
Maturity 3
Verification cost 3
Risk 4