Cursor Review: Agents, Bugbot, Plans, and Limits

What Is Cursor?

Cursor is an AI code editor built on the VS Code codebase, with a coding agent that plans, edits files, runs terminal commands, and drives a browser. The same agent runs in the desktop editor, in a terminal through Cursor CLI, and in Cloud Agents that work inside cloud virtual machines.

Cursor's VS Code migration guide says Cursor is based upon the VS Code codebase, and its one-click import brings over your extensions, themes, settings, and keybindings.

Cursor's SpaceX announcement says Cursor has officially been acquired by SpaceX, completing a process that started in April with a SpaceXAI partnership on model training.

You can work with Cursor's agent from several places:

• Desktop editor - Agent, Plan Mode, and a browser pane, alongside the VS Code editing features you import.
• Cursor CLI - the agent command for terminals and CI, with a print mode for scripts.
• Cloud Agents - agents in isolated cloud VMs, started from the desktop app, the web, Slack, a GitHub or Bitbucket comment, Linear, the iOS app, or the API.
• Cursor for iOS - starts Cloud Agents, and through Remote Control shows and replies to local agents running on your computer.

Cursor Changes Since August 2026

Check any Cursor review's date before trusting its plan or model list. Cursor's changelog shows how much has shipped since the acquisition:

• September 23 - Rollouts and Security Review launch on Teams and Enterprise plans. Rollouts watches each change as it deploys and reports its health per environment, and Security Review reports exploitable bugs on every pull request.
• October 6 - Remote control for local agents lets the Cursor iOS app see and reply to agents running on your computer. It is on by default for everyone except Enterprise organizations.
• October 13 - with the Origin App Marketplace, Origin integrates with over 20 apps for deployments, CI, code review, security, monitoring, and project management, and the marketplace opens to public submissions.
• October 16 - Cloud agent canvases arrive, and cloud environments now support up to 300 repositories, with large environments loading 5x faster.
• October 20 - the Agent SDK defines an agent as a folder of code that you test with evals and deploy to Cursor or to your own infrastructure.
• October 29 - Cursor reports that a malicious build of a Claude Code extension was briefly available in its extension marketplace, covered under privacy and security below.

The plan change matters most for existing users. New customers now start on The X Subscription, and the older Pro, Pro+, and Ultra plans continue only for people already on them.

Cursor Features Reviewed

The table rates each part of Cursor on what it does, which plan includes it, and how it holds up for a team that ships to production.

Cursor's Cloud Agents docs describe agents that run in isolated VMs with cloned repos, installed dependencies, secrets, startup commands, and network access, so they can build, test, and interact with the software they change.

Commit project conventions to AGENTS.md or .cursor/rules so every agent, local or cloud, reads the same instructions. The rule types and their frontmatter are covered in Cursor rules.

Bugbot and the Cursor Review Command

Bugbot is Cursor's pull request reviewer. It runs on every PR update for repositories where it is turned on, and commenting cursor review or bugbot run on a pull request starts a review by hand.

Cursor's Bugbot docs list GitHub, GitLab, Bitbucket, Azure DevOps, and Origin as supported, and say Bugbot reads existing PR comments so it does not repeat earlier suggestions. Those docs also explain the settings that decide whether Bugbot changes what gets merged:

• Findings do not block merges by default - the Cursor Bugbot check reports neutral when it finds issues, so requiring the check in branch protection only proves it ran. Turn on fail-on-unresolved issues, where your organization has it, to make findings fail the check.
• Project rules do not reach Bugbot - .cursor/rules files are ignored in Bugbot runs. Review guidance goes in .cursor/BUGBOT.md files, which Bugbot loads from the repository root and from folders above each changed file.
• Rule size caps - each rule is truncated at 30,000 characters, and all rules for one review are capped at 100,000 characters.
• Learned rules - Bugbot learns from merged or closed pull requests, and a PR comment of @cursor remember followed by a fact saves a rule for future reviews.
• Autofix - Autofix starts a Cloud Agent to fix what Bugbot found and bills Cloud Agent usage, so it needs prepaid credit on The X Subscription.

Bugbot reviews the diff, so the useful rules point it at gaps a diff can show, such as a changed form handler with no end-to-end test. A root .cursor/BUGBOT.md for a web app might read:

# Review rules for this repository

## Tests
- Flag any change to a form handler, auth flow, or checkout step that has no matching end-to-end check under e2e/.
- Flag tests that only assert a function was called, with no assertion on what the user sees.

## Security
- Flag API routes that read the request body without schema validation.
- Flag secrets, tokens, or connection strings committed in source or .env files.

Bugbot never opens the running app, so a rule can ask for a test but cannot confirm the feature works. For how Bugbot compares with other AI reviewers, see code review tools.

How Cursor Checks Its Own Work

Cursor checks its work in three places: the agent's browser tool during a task, Bugbot and Security Review on the pull request, and Rollouts after deploy. In each one, Cursor is grading code that a Cursor agent may have written.

Cursor's browser tool docs say the agent can navigate, click, type, and take screenshots, with full access to console logs and network traffic, and that it reads screenshots as images rather than text descriptions.

The Rollouts docs say Rollouts writes a rollout plan when a pull request opens, checks the change against your telemetry after it deploys, and reports its health in every environment, on Teams and Enterprise plans.

The browser tool reports back to the agent that wrote the code. A separate check that drives the app like a user and exits non-zero on failure gives you a verdict the coding agent did not write.

TestMu AI's demo shows that split in practice. Cursor's agent builds a Next.js app with Supabase email OTP sign-in from one prompt, on Cursor's Free plan, while Kane CLI is installed in the terminal pane beside it:

Kane CLI then runs the sign-in journey from Cursor's integrated terminal as one natural-language objective: open localhost, enter the email, request the code, verify it, and assert that the page contains Welcome. It breaks the objective into checkpoints and works through them in Chrome:

When the OTP screen appears, Kane CLI pauses and asks for the one-time code instead of scraping an inbox, then finishes the journey. The run passes and saves to KaneAI as a test case with a shareable link. The full demo:

TestMu AI's Kane CLI is an agentic quality verifier: a browser agent that validates rendered UI in a real Chrome browser from a natural-language objective. It takes only actions a real user could take, so it will not inject JavaScript to skip a broken modal or force-click a hidden button to manufacture a pass.

• Agent mode - kane-cli run with --agent --headless streams NDJSON events and ends with a run_end event that Cursor's agent can parse.
• Exit codes - 0 for a pass, 1 for a fail, 2 for setup or authentication errors, and 3 for a timeout, so a script can tell a broken app from a broken setup.
• Credits - the CLI is free to install, and runs use KaneAI credits whether they run on your machine or on the TestMu AI cloud grid.

To teach Cursor's agent the commands, append TestMu AI's instruction file to AGENTS.md, as the Kane CLI with AI coding agents guide describes:

npm install -g @testmuai/kane-cli
kane-cli login

# Cursor reads AGENTS.md at the repository root
curl -fsSL https://www.testmuai.com/kane-cli-agent/AGENTS.md >> AGENTS.md

To make the check a gate rather than an instruction the agent may skip, call it from a Cursor stop hook that sends a failed check back to the agent as a follow-up message. The hook script and hooks.json are in Kiro vs Cursor.

Cursor CLI on Windows and in CI

Cursor CLI installs natively on Windows with a PowerShell one-liner, and on macOS, Linux, and WSL with a curl script, according to Cursor's CLI installation docs. Either way, the command is agent.

# Windows (PowerShell)
irm 'https://cursor.com/install?win32=true' | iex

# macOS, Linux, and WSL
curl https://cursor.com/install -fsS | bash

Before you log in, the CLI reports its state like this, so a pipeline should read the output as well as the exit code:

PS> agent --version
2026.10.22-27dcf5f

PS> agent status
Not logged in
PS> $LASTEXITCODE
0

PS> agent -p "Say hello"
Error: Authentication required. Please run 'agent login' first, or set CURSOR_API_KEY environment variable.
PS> $LASTEXITCODE
1

• agent status succeeds when logged out - it prints Not logged in and still exits 0, so a pre-flight step that checks only the exit code passes with no credentials.
• agent -p exits 1 without credentials - check that CURSOR_API_KEY is set, or look for the Authentication required message, before treating a non-zero exit as a problem in the code.

Cursor's CLI authentication docs recommend browser-based agent login, and for automation, scripts, or CI environments, a user API key from the Cursor dashboard set as CURSOR_API_KEY.

Running agent --help lists the flags that matter for automation:

• -p, --print - non-interactive mode for scripts, with --output-format set to text, json, or stream-json.
• -f, --force - allows commands unless explicitly denied, with --yolo as an alias.
• --auto-review - a server-side classifier runs safe tool calls automatically and prompts for the rest.
• --sandbox and --mode - turn the sandbox on or off for a run, or start in read-only plan or ask mode.
• -w, --worktree - starts the agent in an isolated git worktree, so a run does not touch your checkout.
• agent worker - runs a self-hosted Cloud Agent worker. Without --pool it is a personal My Machines worker that needs no Enterprise plan; with --pool it joins a team pool.

Cursor's headless CLI docs say that in print mode, changes are only proposed, not applied, unless you add --force.

Cursor's My Machines docs say the agent loop runs in Cursor's cloud while terminal commands, file edits, and browser actions execute on your machine, over an outbound connection that needs no inbound ports.

A full GitHub Actions workflow and the remaining flags are in Cursor CLI.

Cursor Plans and Pricing Structure

Cursor is sold through The X Subscription, one subscription for Grok, Cursor, and X. Each paid plan includes a weekly usage pool for Cursor's own models, and third-party models bill separately.

Cursor's models and pricing docs say the pool covers Grok 4.7, Grok 4.6, Grok 4.5, and Composer 2.5, is shared across the editor, the CLI, Cloud Agents, Grok Bot, and the Grok apps, and refreshes weekly.

Plus is the lowest-priced paid plan, but it locks you to Cursor's models at medium effort with Fast mode off. Check Cursor's pricing page for current prices before you budget.

Privacy and Security

Cursor's privacy and data governance docs say that with Privacy Mode on, your code is never used for training by Cursor or other AI model providers, and that Privacy Mode is on by default for Enterprise teams.

Most models run under zero data retention agreements. Claude Fable models are an exception: Anthropic stores their inputs and outputs for harm-prevention reviews, so with Privacy Mode on, requests to them fail until an admin approves that retention policy.

Cursor's AIUC-1 certification post says Schellman audited Cursor's controls, and that two rounds of adversarial testing across several thousand scenarios exercised its rules, hooks, and Auto-review safeguards before Cursor passed the AIUC-1 requirements.

Cursor's October 29 security notice reports that malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension were available in the Cursor VS Code Extension Marketplace between 2:27am and 1:35pm PT, and tried to install a persistent SSH backdoor.

Cursor removed the versions, shut down and rebuilt the marketplace, and published a script to check affected machines. On shared team machines, review extension updates before they roll out, and turn on Privacy Mode before an agent reads a private repository.

Cursor Pros and Cons

Cursor's strengths sit in the editor and the agent surfaces around it. Its weaknesses are mostly plan limits and checks that stay inside Cursor.

Cursor's Origin docs say Origin is in early beta and that its code storage is not available on Free or Plus.

Is Cursor Worth Paying For?

Yes for developers who already work in VS Code and want an agent in the editor, and for teams that will use Cloud Agents and Bugbot on Premium or above. Plus suits developers who are happy with Cursor's own models, while heavy Claude or GPT users pay API list price on top of the plan.

Stack Overflow's AI coding agents survey data gives a read on developer intent: 1,436 of 12,255 respondents, or 11.7%, said they want to use Cursor in the next six months.

• Solo developer trying AI coding - start on Free, and move to Plus if Composer and Grok models cover your work.
• Developer who relies on Claude or GPT - Premium with prepaid credit, or compare a terminal-first agent in Claude Code vs Cursor.
• Team that reviews every pull request - Premium seats for Bugbot, with fail-on-unresolved issues turned on and BUGBOT.md rules committed.
• Enterprise - Teams or Enterprise for Rollouts, Security Review, Cursor Router, and Privacy Mode on by default.
• Team weighing Google's IDE - compare agents, plans, and browser control in Antigravity vs Cursor.

Conclusion

Install Cursor on the Free plan, import your VS Code profile, and give the agent one real task from your backlog. Before you trust the result, append the Kane CLI instruction file to AGENTS.md and have the agent run the journey it changed. The Kane CLI introduction covers sign-in and the first run.

Testing from the terminal? Kane CLI by TestMu AI lets SDETs and developers plan, write, run and debug tests from the command line.

To run your first test, start free, or

book a demo

for a full walkthrough of the product.