Cursor adds deployment monitoring and security review bots
Cursor launched Rollouts and Security Review, two enterprise bots that monitor production changes and inspect pull requests for exploitable flaws.
What happened
Cursor launched two bots for software teams: Rollouts monitors changes from pull request to deployment, while Security Review examines every pull request for exploitable vulnerabilities. Both are available immediately on Teams and Enterprise plans.
Rollouts reads a change and the systems it touches, then writes a monitoring plan identifying intended effects, likely risks, required signals and instrumentation gaps. After deployment, it compares telemetry across environments and reports whether the change is healthy, regressed or inconclusive. It can identify a suspected change and, depending on configuration, open a revert pull request or hand the issue to another cloud agent. It does not merge or roll back automatically.
Security Review analyzes code in the context of the wider repository rather than relying only on pattern matching. Cursor says it checks injection paths, authentication and authorization failures, secrets, unsafe deserialization, unvalidated redirects, vulnerable dependencies and insecure infrastructure defaults. The company’s Chinese-language product page says average review time fell from 4.8 to 3.8 minutes and comment acceptance rose from roughly 45–50% to 60–70% in its testing.
Why it matters
The release extends coding agents beyond code generation into the operational work that determines whether generated changes can safely ship. Monitoring plans and security findings become part of the pull-request workflow, giving teams a way to inspect agent-written changes after they leave the editor.
The limits are equally important. Rollouts depends on connected deployment and telemetry systems, and its most consequential actions still require human review. Security Review is also a second opinion, not proof that a repository is secure. The strategic signal is that agent competition is moving toward ownership of the software lifecycle, where reliability evidence may matter more than another coding benchmark.