Cursor

On 23 September 2026, Cursor launched Rollouts for Teams and Enterprise to monitor deployments and hand repairs to cloud agents, without autonomous merge or rollback. The operator’s trial is whether fewer dashboard checks outweigh monitoring-plan review and regression triage.

As of 13 October, start with IDE 3.24.18 from Cursor downloads for supervised development. Before unattended work, test containment: Run Everything defaults to no sandbox, and Auto-review can approve retries outside it.

Where it stands, 2026-10-13

If you use Origin apps, review their credentials after the 13 October marketplace launch. The 13 October 2026 marketplace launch lets apps authenticate with installation tokens and write checks, comments and reviews. Inspect permissions and delegation. Origin’s IP allowlist covers user credentials while excluding app and service-account credentials. Classify an agent by the credential it uses.

Choose and verify each Cursor installation separately. Choose the IDE for supervised development, the agent CLI for terminal work or the SDK for embedding. Check the returned version against this snapshot. The direct IDE and CLI archive links below are for Apple Silicon macOS.

Surface	Version and installation	Channel and limit
IDE and Agents Window	3.24.18 from Cursor downloads	Available on 13 October 2026, corroborated by that evening’s cask update.
Agent CLI	2026.10.01-e373342, via the CLI installer	Homebrew records this build; Cursor’s default installer selection at the 13 October 2026 cutoff is unverified. A timestamped vendor installer capture would settle it; select this build with the versioned archive.
Agent CLI lab	2026.10.12-d47ca18, versioned archive	Archive dated 12 October 2026; default-versus-lab membership at the 13 October cutoff is unverified. Timestamped captures of both vendor installer selectors would settle it.
SDK	@cursor/sdk@1.0.37 or cursor-sdk==1.0.37	Stable registry releases.
iOS	1.13.0 from the App Store	Release dated 6 October 2026; store metadata read on 14 October 2026.
Origin CLI	2026.10.13-14-06-43-ea1dfe5 via its SHA256-checking installer	Stable selector read on 14 October 2026; the artifact dates to 13 October 2026.

Pin the agent CLI archive and stop its updater. Record the archive’s SHA256 and set "channel": "static" in ~/.cursor/cli-config.json to stop background and manual updates. The inspected bundle’s updater downloads without a digest check; a versioned URL alone does not disable updates. Compare agent --version with your pin.

The CLI’s Workspace-read control also depends on a server-controlled switch; verify it on your account before relying on it. Grok Bot’s meeting terms do not establish that meetings are available.

Delegate deployment watching, keep a human merge owner

Try Rollouts on one deploy with a named merge and rollback owner. Review its monitoring plan and use read-only telemetry. The proposed agent loop reaches beyond code production into deploy verification.

Measure verified regressions and triage minutes, including plan review and exceptions, before deciding whether Rollouts saves attention.

Test the billed identity before letting Projects run unattended. Projects can start parallel agents; its docs include Enterprise on 3.21.9 or later without a GA declaration. Check Team Settings > Chat > Enable Projects and confirm availability. Service-account billing-period limits exist. Test what your limit caps; the per-Project limit remains unresolved.

Set Bugbot’s team budget before token-billed team runs. The hosted notes put those runs under the team’s spend limit rather than the installer’s personal limit.

Contain local work before granting unattended access

Choose a sandboxed IDE mode when containment matters. The IDE 3.24 note says Run Everything runs without a sandbox by default. Auto-review can approve a sandbox-refused command to retry outside the sandbox. Narrow access and test a refused command before delegating consequential work.

Make outside-workspace reads an admin decision. Read Access requires IDE 3.23 and defaults to System. A repository’s sandbox.json can replace the user’s read boundary and allowlist. On Enterprise, set team Workspace policy and disable Read Control User Extensions to exclude member and repository additions. Plan for more approval prompts; this control does not constrain Run Everything.

Recheck earlier commits and approvals after upgrading. Cursor reports crafted branch names enabling shell injection before the IDE 3.24 repair, the 3.22 repair for Source Control commits skipping repository hooks and the 3.23 repair for Auto-review approving confirmation-required MCP calls. Run Everything and allowlisted tools still skip that approval card. Inspect earlier commits that relied on secret-scanning hooks and MCP actions that required approval. For Bugbot, inspect earlier Autofix commits where branch separation mattered: New Branch mode could write to the PR branch before the hosted repair. Follow the per-product repair notes alongside advisories.

Make a hook prove it ran before trusting it. The IDE and Agents Window 3.23 notes repair extensionless Windows hooks that reported success without executing. Inspect those commands, test an observable effect and recheck pre-3.23 approval or audit coverage. For MCP allowlist hooks, match mcp_server_name plus tool_name, deny missing identity and set failClosed: true. Test an actual denial.

Review phone pairing before leaving local work unattended. The 6 October 2026 announcement keeps Remote Control execution local, requires desktop pairing approval and defaults on outside Enterprise. Check paired devices and the computer’s run mode.

Qualify workers and integrations separately

Pass SDK restrictions to children explicitly. The TypeScript local SDK’s declarations say local.subagentInherit opts Task descendants into selected executor, workspace and tool-limit settings; leaving it unset omits the parent’s tool-allowlist headers. Before delegating sensitive work, test runtime enforcement by trying a denied tool in a child and a nested child.

Clear shared worker checkouts between jobs until cleanup is verified. The inspected lab artifact refuses reuse when untracked agent configuration remains; the October 1 artifact checks tracked dirt without that extra check. Until you verify cleanup in your worker build, clear directories or keep one trust level per pool.

Review what leaves before buying self-hosting for residency. The worker docs list file contents, terminal output, diffs, screenshots and local MCP results leaving the machine; blocking the artifact bucket does not stop tool-result transmission.

Replace cloud wildcards when the parent domain should stay out. The Cloud Agents notes make *.example.com include example.com. Use explicit destinations if the parent belongs to another trust level.

Update cloud jobs that depended on removed choices. The cloud notes remove Long-running mode from the web and make builds automatic for non-draft environments. Adjust job setup and account for automatic builds and recurring failures.

Migrate Origin automation before rerunning it. The Early Beta API replaces parentPullNumber with parentPullRequest.number and rejects numeric ruleset bypass-user IDs in favor of public user IDs. The CLI notes remove origin pr stack and PR-targeting --branch. Update schemas, stored identities and scripts. Check your binary for the documented origin pr requirements and origin pr merge --expect-head <number>=<sha> before relying on them to bind a merge to the reviewed head. Their inclusion and runtime behavior were not tested.

What is unresolved

• Verify Run Everything’s configuration exception before relying on it. The 3.24 note names a permissions.json exception, but the reference names no field for it. A documented restriction and a denied-command test on the chosen IDE build would show what survives Run Everything.
• Verify Workspace reads on your CLI account. The October 1 CLI code contains a Workspace-read switch controlled by Cursor’s servers. Its presence does not show whether your account has it enabled. A harmless outside-workspace read with Enterprise team Workspace policy and user extensions disabled would settle that account’s effective boundary on that build.
• Test the Teams switch against a paired phone. The mobile docs describe a cloud-loop opt-in and admin gate. That does not establish control of the announced local path. Client-version documentation and a paired-device test of the admin switch would settle whether Teams can turn that path off.
• Require a tested ceiling before calling a Project budgeted. The Projects docs name no per-Project spend, approval or concurrency setting. Documentation of a ceiling, its billed identity and a boundary test would show which Project work it caps. General account controls do not settle it.
• Verify the actual model before accepting the CLI selection repair. The v2026.09.28 note reports a model-ID prefix-overlap fix without naming the first fixed artifact. A build-addressed note or traced artifact comparison, plus an observed-model test, would identify which binary selects the requested model in the affected case.
• Require artifact-bound evidence for git fsmonitor execution. The inspected lab wrapper disables external diffs and text conversion for five git read operations. Evaluate fsmonitor separately: require an advisory naming affected and fixed CLI artifacts or a reproduction tied to an artifact.
• Require a meeting release and controls before enabling Grok Bot meetings. For Grok Bot, a computer-use product, the 12 October 2026 terms assign required meeting notices and consents to the customer. They do not establish availability or administrative controls. A feature release and administrative documentation would settle those questions. Decide meeting-use policy before allowing it.