Autonomous Security Agents for Continuous Vulnerability Detection and Remediation

cursor · Tech · 2026 · source Agentic: yes · promotional bias: med · source-backed · extracted with prompt 0.5.4 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Continuous application security review and remediation

Cursor's PR velocity increased enough that static analysis and rigid code ownership alone were insufficient for security review, vulnerability discovery, dependency patching, and invariant monitoring at the required scale.

Constraints:

Architecture

Cursor built a fleet of Cursor Automations security agents running on cloud agents with a dedicated serverless security MCP tool. Automations receive webhooks, respond to GitHub PRs, monitor codebase changes, and use the MCP for persistent data, deduplication, formatted Slack reporting, and finding actions. Four workflows layer on this foundation: Agentic Security Review for PR threat-model-specific review and blocking gates, Vuln Hunter for existing-code scans, Anybump for reachable dependency patch PRs, and Invariant Sentinel for daily drift monitoring with memory.

Diagram confidence: explicit (topology described by the source).

flowchart LR
  cursor-automations[Cursor Automations] --> cloud-agents[Cloud agents]
  cloud-agents --> security-mcp[Security MCP]
  security-mcp --> gemini-dedupe-classifier[Gemini dedupe classifier]
  security-mcp --> slack-findings-channel[Slack findings channel]
  slack-findings-channel --> security-team[Security team]
  cursor-automations --> github-pull-requests[GitHub pull requests]
  agentic-security-review[Agentic Security Review] --> github-pull-requests
  agentic-security-review --> security-mcp
  vuln-hunter[Vuln Hunter] --> security-team
  vuln-hunter --> security-mcp
  anybump[Anybump] --> github-pull-requests
  anybump --> canary-deployment-pipeline[Canary deployment pipeline]
  invariant-sentinel[Invariant Sentinel] --> security-mcp
  invariant-sentinel --> slack-findings-channel
Drag to pan · scroll or use +/− to zoom · reconstructed from the source's described component topology

Components

Component Role Interacts with
Cursor Automations Background automation framework for security agents triggered by PRs, webhooks, and code changes. Cloud agents, GitHub pull requests, Security MCP
Cloud agents Agent harness and environment with tools, skills, and observability. Cursor Automations, Security MCP
Security MCP Serverless Lambda tool providing persistent data, deduplication, consistent output, and action handling. Cloud agents, Gemini dedupe classifier, Slack findings channel
Gemini dedupe classifier Classifies semantically different LLM findings that describe the same vulnerability. Security MCP
Slack findings channel Receives consistently formatted security findings for team triage. Security MCP, Security team
Agentic Security Review Threat-model-tuned PR security reviewer with commenting and CI-blocking behavior. GitHub pull requests, Security MCP
Vuln Hunter Scans logical codebase segments for existing vulnerabilities. Security MCP, Security team
Anybump Patches reachable dependency vulnerabilities and opens tested PRs. GitHub pull requests, Canary deployment pipeline
Invariant Sentinel Runs daily to monitor drift against security and compliance invariants. Security MCP, Slack findings channel
GitHub pull requests Surface where agents review code, comment, block gates, and open patch PRs. Cursor Automations, Agentic Security Review, Anybump
Canary deployment pipeline Final safety gate after dependency patch PRs are merged. Anybump
Security team Monitors Slack findings, triages Vuln Hunter findings, and governs security tooling. Slack findings channel, Vuln Hunter

Data flow

GitHub webhooks, PRs, and codebase changes trigger Cursor Automations. Cloud agents run security workflows and call the serverless security MCP when needed. Findings are stored, deduplicated with a Gemini Flash 2.5 classifier, formatted into Slack messages, and either reported, commented on PRs, blocked in CI, snoozed, dismissed, or turned into patch PRs. Dependency patching traces reachable code paths, runs tests, opens a PR after tests pass, and relies on canary deployment before production.

3 supporting quotes
“out-of-the-box integrations for receiving webhooks, responding to GitHub pull requests, and monitoring codebase changes.”article, stated
“Persistent data. The agent uses the MCP to store data, so we can track and measure security impact over time.”article, stated
“runs reachability analysis to narrow vulnerabilities to those that are actually impactful, then traces through the relevant code paths, runs tests, checks for breakage, and opens a PR once tests pass.”article, stated

Why this architecture

Cursor needed security review that could scale with fast PR growth and be tuned to its own threat model. Automations provide event-driven background agents and PR integration, while the security MCP centralizes memory, deduplication, formatting, and action handling. Separate automations let PR review, existing-code hunting, dependency remediation, and invariant monitoring each use the workflow and trigger logic that fits its security job.

3 supporting quotes
“Security tooling based on static analysis or rigid code ownership remains helpful, but is not enough at this scale.”article, stated
“a general-purpose review tool isn't ideal for security because it can't be prompt-tuned to our specific threat model”article, stated
“With this foundation in place, the four security automations detailed below layer on their own workflows and trigger logic.”article, stated

Models used: Cursor cloud agents · Gemini Flash 2.5 · Cursor Automations security agents

Scale

Alternatives considered (roads not taken)

Static analysis and rigid code ownership alone

Rejected because: They remained useful but were not enough at Cursor's increased PR velocity.

“Security tooling based on static analysis or rigid code ownership remains helpful, but is not enough at this scale.”article, stated

General-purpose PR review tool for security

Rejected because: It could not be tuned to Cursor's specific threat model or block CI only on security findings.

“a general-purpose review tool isn't ideal for security because it can't be prompt-tuned to our specific threat model”article, stated
“But a general-purpose review tool isn't ideal for security because it can't be prompt-tuned to our specific threat model, and because we needed the ability to block CI on security findings specifically, without blocking on every general code quality issue.”article, stated

Manual dependency patching by security or engineering backlogs

Rejected because: Dependency patching is time intensive and tends to stall in engineering backlogs.

“Dependency patching is so time intensive that most security teams eventually give up and push it to engineering”article, stated
“We created an automation called Anybump that has entirely automated nearly all of it. [Anybump](https://cursor.”article, stated

One security agent type for every problem

Rejected because: Cursor built separate automations with distinct workflows for PR review, codebase scanning, dependency patching, and invariant drift.

“With this foundation in place, the four security automations detailed below layer on their own workflows and trigger logic.”article, stated

Patterns

tool-use-orchestration (security)

Cursor security agents use webhooks, GitHub PRs, cloud-agent tools, MCP, Slack, tests, canary deployment, and memory.

“receiving webhooks, responding to GitHub pull requests, and monitoring codebase changes”article, stated
“all the tools, skills, and observability that cloud agents have access to.”article, stated

agent-memory (security)

The security MCP stores findings and Sentinel compares current state with previous runs using automation memory.

“The agent uses the MCP to store data, so we can track and measure security impact over time.”article, stated
“the agent compares current state against previous runs using the automations memory feature.”article, stated

semantic-caching (deduplication)

Gemini Flash 2.5 classifies semantically different findings that describe the same underlying security problem.

“a classifier powered by Gemini Flash 2.5 that determines when two semantically distinct findings describe the same problem.”article, stated

guardrails-io-filtering (security)

PR review can block CI specifically on security findings while avoiding unrelated general code-quality blocking.

“block CI on security findings specifically, without blocking on every general code quality issue.”article, stated

eval-driven-development (security)

Anybump traces reachable code paths, runs tests, checks breakage, opens PRs after tests pass, and uses canary deployment before production.

“runs tests, checks for breakage, and opens a PR once tests pass.”article, stated
“Cursor's canary deployment pipeline provides a final safety gate before anything reaches production.”article, stated

Tradeoffs

Use dedicated security automation instead of general PR review

Chose Agentic Security Review over Bugbot/general-purpose review alone.

Rationale: Security needed threat-model tuning and security-specific CI blocking.

“Internally, we were already using Bugbot to review PRs for code quality and general issues”article, stated
“we built a dedicated automation we call [Agentic Security Review]”article, stated

Centralize security agent state and output through MCP

Chose security MCP for persistence, dedupe, and consistent reporting over each automation independently formatting, tracking, and acting on findings.

Rationale: Central MCP data enables impact measurement, trigger refinement, deduplication, and consistent Slack/action handling.

“The MCP, whose reference code is available here, serves three purposes”article, stated
“Agents report every vulnerability they find through the MCP”article, stated

Use canary deployment after automated dependency patching

Chose canary safety gate after tests and PR merge over direct production rollout after generated patch PR.

Rationale: Dependency patches can be impactful, so canary rollout provides a final guard before production.

“After the PR is merged, Cursor's canary deployment pipeline provides a final safety gate before anything reaches production.”article, stated

Gotchas (what bit them)

General review agents were not security-specific enough.

Root cause: General tools could not be tuned to Cursor's threat model or block only security failures.

Resolution: Cursor built Agentic Security Review as a dedicated automation and added PR commenting plus a blocking gate.

“a general-purpose review tool isn't ideal for security”article, stated
“turned on PR commenting, then implemented a blocking gate check.”article, stated

Multiple LLM review agents can produce duplicate security findings.

Root cause: Different agents may describe the same underlying vulnerability with different wording.

Resolution: The MCP uses a Gemini Flash 2.5 classifier to deduplicate semantically distinct findings.

“different agents can end up using different words to describe the same underlying issue.”article, stated
“Gemini Flash 2.5 that determines when two semantically distinct findings describe the same problem.”article, stated

Dependency patching often dies in backlogs.

Root cause: It is time-intensive enough that security teams hand it to engineering, where it sits.

Resolution: Anybump automates reachability analysis, path tracing, tests, PR creation, and canary-gated rollout.

“Dependency patching is so time intensive that most security teams eventually give up and push it to engineering, where it sits in backlogs.”article, stated
“Anybump automatically opens PRs to patch vulnerable dependencies after tests pass.”article, stated

Evaluation

Cursor reports security automation performance through weekly PR review volume, vulnerability counts, Agentic Security Review PR coverage, production-prevention counts, and workflow-specific gates such as tests and canary rollout.

Metrics: PR velocity increased 5x · 3,000+ internal PRs reviewed weekly · 200+ vulnerabilities caught · Agentic Security Review ran on thousands of PRs over two months · hundreds of issues prevented from reaching production

3 supporting quotes
“Over the last nine months, our PR velocity has increased 5x.”article, stated
“Security agents are reviewing 3,000+ internal PRs each week, catching 200+ vulnerabilities”article, stated
“prevented hundreds of issues from reaching production.”article, stated

Outcomes

The source reports 3,000+ internal PRs per week, 200+ vulnerabilities caught, and thousands of PRs reviewed by Agentic Security Review in two months.

3 supporting quotes
“allowed us to quickly build a fleet of security agents that continuously identify and repair vulnerabilities in our codebase.”article, stated
“Today, we're releasing four new automation templates”article, stated
“agents give us coverage and consistency at a scale we couldn't achieve manually.”article, stated