Cursor ships two post-PR bots
Cursor has released Rollouts and Security Reviewer, two bots that monitor deploys and audit pull requests, pushing its coding agents past writing code and into the release and review work that follows.
Cursor said the two bots are aimed at the work that happens after code is written: verifying security, watching deploys, and attributing regressions among concurrent changes.
Rollouts connects to source control, a deploy system, and telemetry — Cursor names Datadog, Grafana, and Honeycomb as examples. Before a merge, it reads the diff and drafts an editable monitoring plan listing perceived risks, the change's intended effects, and gaps where instrumentation cannot confirm whether it worked. After deploy, it compares those signals against a pre-deploy baseline and, on finding a regression, names the change it suspects and proposes an action: a ping to the author, a paused progressive rollout, or a revert PR held for approval. Cursor claims it catches regressions confined to a single endpoint in a single region before a global alert fires, and distinguishes intended effects from regressions. Feature-flag ramping and awareness of release trains and deploy freezes are listed as coming soon.
Security Reviewer runs on every PR and reads changes in whole-codebase context, covering injection (SQL, command, template, LDAP), missing or broken authentication and authorization on new and changed routes, committed secrets, unsafe deserialization, unvalidated redirects, dependency changes pulling in known vulnerabilities, and insecure infrastructure defaults. Each finding carries a severity, an attack path, and a one-click fix.
Both are available now on Teams and Enterprise plans, enabled from the automations tab. Cursor published no benchmarks, false-positive rates, or separate pricing for the bots, and frames the release as a step toward "self-driving codebases."