Cursor’s AI bots now catch security flaws and halt bad deploys

Writing code is the part that attracts most of the tooling and most of the attention. What comes after it merges has always been harder to automate: the anxious wait to see whether a security hole survived review, or whether something quietly broke in production. Cursor’s two new bots, Rollouts and Security Reviewer, are built for exactly that gap.

The Security Reviewer analyzes each code change against the full codebase to find the categories of vulnerability that tend to survive ordinary peer review. It looks for SQL, command, and template injection flaws; missing or broken authentication on routes; credentials accidentally committed to the repository; unsafe deserialization; unvalidated redirects; and known security issues in dependency changes. Each flagged item comes with a severity rating, an explanation of the attack path, and a one-click fix. Average review time has fallen from 4.8 minutes to 3.8 minutes per session, and developers are accepting the bot’s suggestions 60 to 70 percent of the time, up from 45 to 50 percent before.

Rollouts works at the deployment layer. Before a merge, it builds a monitoring plan that maps which parts of the codebase are changing and where the instrumentation gaps are. After the code ships, it compares live signals from Datadog, Grafana, or Honeycomb against pre-deployment baselines. It can distinguish between intentional behavioral changes and actual regressions, which matters enormously when the cost of intervening is a full rollback. When it detects a genuine failure, it can notify the author, pause the rollout, or submit an automated revert pull request before the problem reaches all users.

What separates both tools from most AI coding assistants is where they enter the workflow. The majority of AI tools for developers focus on the writing phase: generating functions, suggesting completions, explaining logic. Rollouts and Security Reviewer operate in the window after writing, when code crosses from a developer’s local machine into shared infrastructure and errors carry real consequences. The Security Reviewer is not evaluating hypothetical code; it is analyzing the specific change that is about to go live.

The limitations deserve equal attention. Rollouts requires three connected systems before it can function: source control, a deployment platform, and at least one observability tool. For smaller teams without observability infrastructure already in place, the setup overhead may outweigh the benefit. The Security Reviewer is limited to Teams and Enterprise subscription tiers, which excludes the independent developers and smaller projects most likely to benefit from automated security help. And no automated tool substitutes for a dedicated security audit on critical systems; the bots can only flag patterns they have been designed to recognize.

Both bots are available globally to Cursor Teams and Enterprise subscribers. Cursor released them on September 23 with a ten-day trial period included: Teams customers receive credits covering approximately 50 code changes and Enterprise customers receive credits for around 500. Feature flag integration and release train awareness for the Rollouts bot are in development.

Tags: Cursor, AI bots, code security, developer tools, Rollouts, Security Reviewer