Cursor in the Enterprise: The Security Review

Cursor is enterprise-safe only on the Enterprise plan, with Privacy Mode enforced, model and MCP access controls set, and versions patched past its 2025–2026 CVE run. Everything below Enterprise leaves security teams mostly blind.

This is the next entry in our enterprise security review series, alongside Claude Cowork and Claude Code, ChatGPT Work, and Gemini Enterprise. The method is the same: the vendor's own security pages first, independent research second, a hardening checklist at the end. Retention and compliance statuses change fast — re-check Cursor's official security and data-use pages before relying on any status here. Last verified: September 5, 2026.

What data does Cursor send off the device?

More than most developers assume. Cursor is not a local editor with optional cloud extras; the AI requests are the product. Cursor's own security page states: "Our app makes requests to Cursor backend domains to deliver API, update, and marketplace functionality." Its data-use page adds that "we temporarily cache file contents on our servers to reduce latency," with caching lasting for the duration of a request, keyed with encrypted, client-generated keys.

From Cursor's backend, prompts and code context go on to model providers. The data-use page names OpenAI and Anthropic among them and states that Cursor "maintains zero data retention (ZDR) agreements with all providers." Third-party hardening guides list the current ZDR set as OpenAI, Anthropic, Google, xAI, and Fireworks — verify the current list on Cursor's data-use page, because it moves.

Codebase indexing is the third flow: code is chunked, uploaded, and embedded so the assistant can search your repository. Per third-party summaries of Cursor's own engineering write-up, plaintext is discarded after embedding, the vector store holds vectors rather than source, filenames are obfuscated, and inactive indexes are deleted after roughly six weeks. Reasonable design — but your code still transits, and briefly resides on, Cursor infrastructure.

Does zero data retention mode actually retain nothing?

Mostly — with one carve-out worth quoting in your risk register. Privacy Mode is Cursor's umbrella control. The security page states: "When enabled, we will not train on your data. We also implement technical controls and contractual requirements with our model providers to protect your data," and confirms Privacy Mode "is available to anyone (free or Pro)." With it on, the data-use page commits that "Customer Data will not be used for training by Cursor," with one stated exception: model providers "may run risk classifiers to detect violations of terms and usage policies."

With Privacy Mode off, the same page is blunt: "we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models."

Now the carve-out. Cursor's enterprise documentation states that most models run under its ZDR agreements, "so providers don't store inputs or outputs or train on your data" — but that Claude Fable-series models require retention "to run automatic and human harm-prevention reviews." Even in a fully enforced ZDR configuration, selecting those Anthropic models means provider-side retention exists for safety review. If a data-handling commitment you have made assumes zero provider retention across the board, gate those models with Cursor's model access controls or amend the commitment.

Which security controls come with which plan?

This is where most Cursor risk actually lives. The certifications are real: Cursor's security page lists "AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation," publishes reports at trust.cursor.com, and states that Cursor maintains no infrastructure in China and uses no China-headquartered subprocessors. But certifications describe Cursor's corporate posture. Your deployment's posture is set by the plan you buy.

Two gaps deserve emphasis. First, defaults. Cursor's enterprise docs state "Privacy Mode is on by default for Enterprise teams" and that admins can enforce it so members can't disable it. Cursor's pages make no equivalent statement for individual accounts, and third-party guides consistently report Privacy Mode is off by default on Free and Pro — meaning every engineer running a personal Cursor license is opted into training until they find the toggle. Second, visibility. Audit logs are an Enterprise-only line item; on Free, Pro, and Teams there is no organizational audit trail at all.

What is Cursor's vulnerability track record?

Busy — and concentrated in the agent and MCP trust model rather than in transport or storage.

• Rules File Backdoor (disclosed early 2025). Pillar Security showed that hidden Unicode characters in rules files could invisibly steer the AI into generating backdoored code that survives human review. Per contemporary reporting, Cursor's position was that this was not a platform vulnerability and that managing the risk is the user's responsibility — which makes rules files part of your supply-chain review, not Cursor's.
• MCPoison, CVE-2025-54136. Check Point Research found MCP configurations were approved once and never re-validated, letting an attacker swap in malicious commands after approval for persistent code execution. Fixed in Cursor 1.3 (July 29, 2025), which made any MCP config change trigger a fresh approval prompt.
• CurXecute, CVE-2025-54135. A widely reported prompt-injection path that could rewrite MCP config files and execute arbitrary commands with developer privileges.
• CVE-2025-59944. Lakera showed Cursor matched protected paths case-sensitively, so a config at .cUrSoR/mcp.json skipped the confirmation prompt on case-insensitive filesystems. Fixed in Cursor 1.7.
• DuneSlide, CVE-2026-50548 and CVE-2026-50549. Two sandbox escapes rated 9.8 CVSS, found by Cato's AI research team and reported by The Hacker News in July 2026. In the first, when the agent set a non-default working directory, "Cursor adds that path to the allowed-write list without question"; the second abused symlink handling. Both were exploitable zero-click via prompt injection from poisoned MCP servers or web results. Reported February 19, 2026, initially rejected, reopened within a week, fixed in Cursor 3.0 on April 2, 2026.

The pattern matters more than any single CVE. The recurring exploit chain is prompt injection plus agent autonomy plus MCP trust — and Privacy Mode does nothing against it. The controls that address it (auto-run, browser, network, and MCP access controls) are Enterprise-tier features.

Can .cursorignore keep secrets out of Cursor?

Partially, and Cursor says so itself. Indexing and context-building can sweep up whatever lives in the repository, including .env files and private keys. The official mitigation is .cursorignore, which ships with default ignores for .env files, keys, and certificates. But Cursor's own documentation carries two caveats worth quoting verbatim in your assessment: "complete protection isn't guaranteed due to LLM unpredictability," and "The terminal and MCP server tools used by Agent cannot block access to code governed by .cursorignore." An agent that can run shell commands can read the file your ignore rules were protecting.

Treat .cursorignore as hygiene, not a control. The real controls are keeping secrets out of repositories entirely, and detection at the endpoint that is independent of the tool — AccuroAI's endpoint layer, for example, detects 60+ secret types in AI-bound traffic regardless of which editor or agent produced it.

What can your security team actually see?

On Enterprise: audit logs, service accounts, usage analytics, an AI code tracking API, SCIM-managed seats, and repository, model, and MCP access controls — a genuinely competitive admin surface. Below Enterprise: usage analytics on Teams, and effectively nothing on individual plans. Locally defined rules files, user-level MCP servers, and the terminal commands an agent runs are not centrally inventoried on lower tiers. And on any plan, Cursor does not document a per-request content log for admins — you can see that Cursor was used, not which code snippets left which laptop. That gap is structural across AI coding assistants, and it pairs with the SaaS-side blind spot we covered in auditing AI app OAuth grants.

How should you harden Cursor before an enterprise rollout?

Nine controls, in order:

• 1. Buy the tier that has the controls. For regulated code that means Enterprise — audit logs, SCIM, and access controls do not exist below it.
• 2. Enforce Privacy Mode org-wide so members cannot disable it, per Cursor's enterprise docs.
• 3. Block personal accounts on corporate devices with Cursor's MDM option — personal Free and Pro use is where training-by-default lives.
• 4. Set a version floor of Cursor 3.0 or later. Earlier versions carry the DuneSlide sandbox escapes.
• 5. Gate models with model access control, and decide explicitly whether Claude Fable-series harm-prevention retention is acceptable for your code.
• 6. Lock down MCP. Use Enterprise MCP access controls, allowlist servers, and review MCP configs in code review like the executable trust decisions they are.
• 7. Restrict auto-run, browser, and network access for agents. Autonomous execution is the active exploit chain.
• 8. Extend .cursorignore, but treat it as best-effort. Cursor's docs concede that terminal and MCP tools bypass it.
• 9. Add tool-independent endpoint monitoring. Cursor's telemetry covers Cursor. An endpoint AI governance layer sees every assistant, agent, and local model on the device — AccuroAI deploys in under 30 minutes and inspects prompts with 40+ data classifiers before they leave the machine.

FAQ

Does Cursor train on my code?

Not with Privacy Mode on — Cursor's security page states "we will not train on your data" when it is enabled. With it off, Cursor may use and store code, prompts, and editor actions for training, per its data-use page. Enterprise defaults to on and can enforce it; individual plans reportedly default to off, so check the toggle.

Which certifications does Cursor hold?

Per its security page: AIUC-1, ISO/IEC 27001:2022, ISO/IEC 42001:2023, and a SOC 2 Type II attestation, with documents at trust.cursor.com. Certification scopes change — re-verify there before an audit.

Does Cursor's zero data retention cover every model?

No. Cursor's enterprise docs state most models run under ZDR agreements, but Claude Fable-series models require retention "to run automatic and human harm-prevention reviews." Use model access controls if that matters for your data.

Have the Cursor CVEs been fixed?

The named ones, yes: MCPoison in Cursor 1.3, the case-sensitivity bypass in 1.7, and both DuneSlide flaws in 3.0 (April 2, 2026). The Rules File Backdoor is a usage-pattern risk Cursor treats as the user's responsibility, so it remains yours to manage.

Related reading: Endpoint AI Governance · Claude Cowork and Claude Code: The Enterprise Security Review · ChatGPT Work: The Enterprise Security Review · Gemini Enterprise Managed Agents: The Security Review