Cursor

An editor rather than a plugin, and increasingly an agent, so the interesting traffic is what it decides to read rather than what the developer typed.

What leaks through it

Repository context by design, plus agent mode: file reads, shell commands and terminal output, all generated by the model rather than the developer. Privacy Mode governs retention at the vendor; it does nothing about what the agent reaches for on the machine.

• api2.cursor.sh

Guardrails once it is inspected

Alectura intercepts only tools it has been tested against. Everything else is discovered, meaning you get the app, the devices running it and how often, but the content is never decrypted, so content rules cannot run on it yet.

Today Cursor is discovered: you get the app, the devices running it and how often, without decrypting anything. The rules below are the ones that apply to it, and they run once it is onboarded for inspection.

• BlockBlock private keysALC-002

  A private key pulled into context stops the request before it is sent upstream.

• AlertCredential file accessALC-011

  The agent opening ~/.aws/credentials, a .env or an id_rsa, raising a finding that names the file rather than a generic policy hit.

• AlertDestructive shell commandsALC-010

  Agent-generated rm -rf, force pushes and drops, caught on the tool input the model emitted.

• AlertAI agent config access & safety bypassALC-021

  The agent editing its own rules or approval settings, which quietly widens everything else it is allowed to do.

Those are the ones worth spelling out for Cursor. All 27 rules in the catalog apply, and you can see the full catalog.

What happens to whatever gets through

Model training

With Privacy Mode on, code is not retained or trained on. With it off, code may be retained to improve the product.

Retention

Privacy Mode enforces zero retention of code; without it, retention applies.

Data residency

US-hosted, with model traffic passing to the underlying model providers.

The vendor’s own controls

• ·Privacy Mode enforced org-wide on Business and Enterprise
• ·SSO and SCIM
• ·Admin visibility into member privacy settings

Sources

• Cursor security
• Cursor privacy policy

Vendor terms last checked August 14, 2026, and summarised from Anysphere’s published documentation. Confirm against the sources above before writing policy around this page.