Cursor launches Rollouts and Security Review bots for production changes

Cursor has launched two bots for the last mile of shipping code: Rollouts watches a change from pull request to production, while Security Review looks for exploitable bugs in pull requests. Cursor says both are available on Teams and Enterprise plans.

Rollouts connects pull requests to production signals

Rollouts attaches a monitor to a pull request and creates a monitoring plan from the diff, the systems it touches, the intended effect, and the signals that can verify the change. Teams can edit that plan in the pull request before deployment.

After a deploy event, Rollouts compares logs, metrics, and traces against the pre-deploy baseline. It tracks environments separately, so a change can be healthy in staging and still show a regression in production. Its verdict can be verified healthy, regression detected, or inconclusive.

When it finds a regression, Rollouts names the suspected change and notifies the author. Cursor says it can also open a revert pull request for review or hand the finding to a cloud agent for a fix, but it does not merge or roll back on its own.

Rollouts connects to Cursor Origin or GitHub for source control, a continuous-delivery system for deploy events, and telemetry providers such as Datadog. Cursor says feature-flag integration is coming later.

Security Review focuses on exploitable bugs

Security Review reads each non-draft pull request in the context of the codebase and posts one review comment about exploitable issues. Cursor distinguishes this from Bugbot: style and general quality feedback remain with Bugbot.

The initial checks cover injection across SQL, command, and template surfaces; authentication and authorization bypasses; secrets and credentials; SSRF and unvalidated redirects; unsafe deserialization; and dependency changes that introduce known vulnerabilities. Each finding includes a severity, an attack path, and a proposed fix.

Teams can add rules for repository-specific constraints, such as routing external calls through a particular client or preventing request handlers from querying certain tables. Dismissing a finding with a reason tells Security Review not to raise it again on that pull request.

Availability and a sensible rollout

Enable either bot from Cursor’s automations dashboard. Cursor says the first ten days include usage credits for real changes, with roughly 50 changes for Teams customers and 500 for Enterprise customers.

These bots connect automation to production and security decisions, so start with a repository that has reliable deployment telemetry and a review policy for proposed fixes. Confirm the telemetry signals, pull-request permissions, and rollback approval path before allowing an agent to open remediation work automatically.

Sources

• Cursor — “Rollouts and Security Review” (September 23, 2026): https://cursor.com/changelog/rollouts-and-security-reviewer
• Cursor — “Bots for the last mile: Rollouts, Security Review”: https://cursor.com/blog/rollouts-and-security-reviewer
• Cursor on X — official product updates: https://x.com/cursor_ai