Cursor's deploy bots deserve a 10-day trial, not your trust

Cursor shipped two bots on September 23, aimed at the part of shipping code that still hurts: everything after the PR goes up. Rollouts watches a change from the moment the PR opens until the team trusts it in production. Security Reviewer scans every PR (draft PRs are skipped) for exploitable bugs in what Cursor claims is 3.8 minutes on average. Both are available to Teams and Enterprise customers, with a 10-day credit window that closes around October 3.

What Rollouts does

When a PR opens, Rollouts reads the diff, identifies which systems the change touches, and writes a monitoring plan as a PR comment. The plan lists the risks it sees, the effect the change is supposed to have, the signals it will check, and the places where your instrumentation cannot tell whether the change worked. Engineers can edit the plan before merge, and the bot enforces the revised version. It connects to source control, your deploy system, and telemetry like Datadog, Grafana, or Honeycomb.

After a deploy event, it compares the plan's signals against the pre-deploy baseline, tracking each environment separately. A change can pass staging and fail production. Each change gets one of three statuses: verified healthy, regression detected, or inconclusive.

When it finds a regression, it names the change it suspects and notifies the author. Depending on configuration, the response can be a ping to the author or a paused progressive rollout, and it can open a revert PR waiting for approval. It does not merge or roll back on its own today. Cursor is explicit about that guardrail.

Security Reviewer, the companion update, runs on every PR and reads the change in the context of the whole codebase. Each finding carries a severity, an attack path, and a one-click fix. Out of the box it looks for injection across SQL, command, template, and LDAP surfaces, broken authentication on new or changed routes, secrets committed to source, unsafe deserialization, unvalidated redirects, vulnerable dependencies, and insecure defaults in infrastructure and config.

The vendor numbers

Cursor's headline figures are vendor claims, and they should be read as such. Review time fell from 4.8 to 3.8 minutes on average, a 21% reduction, and comment acceptance rose from 45-50% to 60-70%. Both figures come from Cursor's own published graphic. The second one deserves a harder look. A comment "accepted" by an engineer is not the same thing as a vulnerability correctly identified. The sample window and denominator are unstated.

Speed matters for a different reason: reviews that finish before engineers merge get waited for, and reviews that lag get skipped. Track your own acceptance rate during the trial, and decide up front who owns false-positive triage. That ownership question decides whether the bot reduces your workload or just reorganizes it. Unattended agent automation keeps causing incidents (the 27-company breach playbook is open source now); a security bot needs a human who owns its false positives.

Why the plan at PR time is the actual feature

Plenty of tools can point an AI at an error dashboard. What is harder, and what Rollouts attempts, is writing the monitoring plan at PR time, when the context about what the change is supposed to do is still fresh. Most teams do observability backwards: they pick the metrics after the first incident surfaces the gap. Rollouts forces the question before merge. What would this change look like if it went wrong, and would we see it?

The most valuable line in a plan may be the instrumentation gap. "No metric exists for cache key collisions" is more useful than another passing check. It turns a deploy bot into a reviewer that finds your observability debt before production does. Cursor calls this the most common reason a bad change goes unnoticed.

The honest "inconclusive" verdict is the other good design choice. An agent that admits it lacks enough signal is more useful than one that always reports healthy. Track the inconclusive rate during your trial. A high rate usually maps your missing telemetry, not a weak agent. Either way, it tells you something.

What to measure in the 10-day window

Cursor includes roughly 50 changes of credit for Teams plans and 500 for Enterprise, per changelog reporting, with the window closing around October 3. That is enough for a real evaluation if you plan it.

First, plan quality. Hand-review the first five plans. Do the signals name specific routes and tenants, or global dashboards? Edit the plans and watch how the bot responds to corrections.

Second, verdict quality. Count true positives, false alarms, and inconclusive results. Regression accuracy is the number that matters, not verdict volume.

Third, your own Security Reviewer acceptance rate, plus the false-positive triage owner. Settle that before the bot trains anyone to rubber-stamp.

Fourth, attribution under pressure. What happens when two PRs deploy close together? The suspected-change logic is the weak link in multi-service changes.

Fifth, the revert path. Open a revert PR in staging. Does it make sense? Would you merge it?

Pick low-risk services with good telemetry for the trial. Rollouts can only verify what you measure, so the trial doubles as an audit of your own observability. If your dashboards are full of ignored alerts, the bot inherits the noise. If they are clean, the plans will surface what is missing.

Keep the human gate

Cursor says Rollouts does not autonomously merge or roll back today. That is the right default, and you should keep it. A revert PR awaiting approval is a proposal; a wrong verdict is cheap. An autonomous rollback is an action, and a wrong one pages everyone and compounds. The vendor roadmap points toward feature-flag integration, which would let the bot ramp traffic directly. Decide your policy on that autonomy now, before it ships.

What remains unknown

Post-trial pricing is unstated everywhere we looked, and the credit figures come from changelog reporting rather than a Cursor pricing page. All headline performance figures are vendor-supplied, and none of this has been tested by anyone we can verify. The trial is the evidence: ten days is enough to measure, not enough to trust.

The design is sound. A plan written at PR time, per-environment verdicts, an honest inconclusive, no autonomous rollback. Whether it survives your telemetry is the open question. Cursor is bidding for the step right after the merge, where teams are least attentive and incidents are most expensive, in the middle of an aggressive coding-agent price war (see what the major agents actually cost this month). Use the window to find out if the bid holds.