Cursor is a proprietary AI-assisted code editor and software-development platform made by Anysphere.[25] The desktop editor is based on the Visual Studio Code codebase and combines code completion, natural-language editing, repository-aware chat, and agents that can edit files and run development tools.[2][3][4][5]

Beyond desktop editing, Cursor provides a command-line agent, remote cloud agents, automated workflows, and pull-request review.[7][9][10][23] Its AI features use both Anysphere models and models from other providers.[14]

Anysphere was founded by Michael Truell, Sualeh Asif, Arvid Lunnemark, and Aman Sanger, who met at the Massachusetts Institute of Technology. The company announced an $8 million seed round in October 2023, followed by four larger venture rounds through November 2025.[1][17][18][19][20] In June 2026, SpaceX and Anysphere signed a merger agreement that valued Anysphere at an implied $60 billion. The Securities and Exchange Commission filing described a pending all-stock transaction, subject to closing conditions and regulatory approvals, and said SpaceX expected it to close in the third quarter of 2026.[22]

Cursor is one example of applying artificial intelligence, particularly large language models, to interactive software development. Its practical effect depends on the task, model, repository, developer experience, review process, and version of the product. Research available by July 28, 2026 did not support treating any single productivity or code-quality result as a universal property of Cursor.[30][31]

Product

Editor foundation

Cursor's desktop application retains much of the interface and extension ecosystem familiar to Visual Studio Code users. Its migration tool can import Visual Studio Code extensions, themes, settings, and keybindings. Documented editing workflows include Tab completion, Inline Edit, and Agent.[2][3][4][5]

Tab is Cursor's AI-powered autocomplete. It can suggest multi-line or coordinated cross-file edits and can jump to a predicted next editing location. The user can accept or reject each suggestion. Inline Edit applies a natural-language instruction to selected code and can pass the selected code to Agent for more complex or multi-file changes.[3][4]

These features differ in scope. Tab predicts a next edit while the developer remains in the normal editing loop. Inline Edit applies a requested transformation to selected code. Agent can search a repository, edit files, run terminal commands, and use configured external tools. Treating all three as a single autocomplete feature obscures their different permissions and review requirements.[3][4][5][13]

Agent and parallel work

Cursor describes Agent as an assistant for complex coding tasks. Its documented tools can search the codebase and web, edit files, and run shell commands; optional MCP servers can extend it with outside tools and data.[5][13]

Cursor 3.0, released in April 2026, introduced an Agents Window for running several agents across local repositories, Git worktrees, cloud environments, and remote SSH environments. Agent tabs can show multiple conversations at once. Design Mode lets a user annotate interface elements in a browser and attach them to an agent request. These are orchestration and interface features; they do not establish that parallel agents produce correct or mergeable changes.[6]

Cloud agents and automations

Cloud agents run asynchronously in isolated virtual machines with development environments that can contain cloned repositories, dependencies, startup commands, secrets, and network access. A cloud agent can clone an authorized GitHub repository, work on a separate branch, run commands, and push changes back for handoff. Cursor also documents starting and monitoring agents through its web interface, a native iOS application in beta, and an Android progressive web application.[7][8]

The documented cloud environment can combine source-control write access, secrets, external tools, and network access. Cursor documents controls for secrets and outbound domains; repository permissions, secrets, network access, and generated changes therefore require review.[7]

Cursor Automations, introduced in March 2026, run cloud agents on a schedule or in response to events. Documented triggers include Slack messages, Linear issues, GitHub pull-request events, PagerDuty incidents, and custom webhooks. A run starts a cloud sandbox and can use the models and MCP servers configured for that automation. Automations can open pull requests or post results to connected services, so their identities and permissions are part of the automation's security boundary.[10]

Command-line and review tools

Cursor CLI provides the agent outside the graphical editor. Its documented interface supports interactive sessions and a non-interactive print mode suitable for scripts. The CLI can read and edit files, search, run shell commands, load project rules, and use MCP configurations. Interactive terminal commands require approval by default, while non-interactive mode has full write access and should be run with controls appropriate to the repository and execution environment.[9]

Bugbot is Cursor's agentic code-review product. It is offered to individuals through usage-based billing and to teams through plan features. Like other automated review tools, it adds a review signal rather than replacing tests, security analysis, or accountable human approval.[23][25]

Context, models, and extensions

Repository context

Cursor can index a repository to retrieve code that may be relevant to a request. Its data-use documentation says that indexing uploads code in small chunks to compute embeddings. Plaintext code used to compute embeddings ceases to exist after the request, while embeddings and metadata such as hashes and filenames may be stored. Cursor also describes a temporary encrypted file cache whose client-generated encryption keys exist on its servers only for the request.[24]

Cursor's prompting documentation lets users explicitly attach files and folders; when relevant files are unknown, Agent can search for them. It also describes a fixed model context window and compression of older conversation content as the window fills. These mechanisms mean the model works from selected or summarized context rather than a guaranteed complete dependency graph.[12]

Rules

Cursor Rules supply reusable instructions to Agent. Project rules live under .cursor/rules as .mdc files and can be version-controlled, scoped by file patterns, selected by the agent, or invoked manually. User rules apply across the user's environment, team rules can be managed centrally on qualifying plans, and Cursor also reads AGENTS.md. Rules become prompt context rather than an enforcement mechanism.[11]

Cursor advises keeping rules focused, concrete, and scoped, and explains that rule content is inserted into the model context. It also says that even enforced team rules should not be the only security control.[11]

Model selection and API keys

Cursor exposes a changing catalog of models rather than one fixed model. The catalog includes Anysphere's own systems and models supplied by other companies. Composer, announced in October 2025, was described by Anysphere as a mixture-of-experts language model trained for software-engineering tasks with reinforcement learning. Vendor benchmark claims about Composer do not by themselves establish performance on a user's repository.[14][16]

Users can configure keys for selected providers, including OpenAI, Anthropic, and Google, subject to current product support. Cursor states that bring-your-own-key requests still pass through its backend for final prompt construction. User-supplied keys apply to standard chat models, while features such as Tab continue to use Cursor's built-in models. Provider availability, context limits, and billing can change, so a static list of model versions becomes stale quickly.[15][24]

Model Context Protocol

Cursor supports the Model Context Protocol for connecting agents to external tools and data. Its documentation covers local standard-input/output servers and remote SSE or streamable-HTTP servers, as well as MCP tools, prompts, roots, and elicitation. Tool calls require approval by default, although users can opt into automatic execution.[13]

Because MCP servers can access external services and execute code, Cursor advises users to verify the source, review permissions, restrict API keys, and audit code for critical integrations before installation.[13]

History and company

Founding and early product

Anysphere's four co-founders met at MIT and built Cursor as a fork of Visual Studio Code. In October 2023, TechCrunch reported an $8 million seed round led by the OpenAI Startup Fund, bringing the company's disclosed total at that point to $11 million. The early product combined code generation, codebase questions, and bug-finding functions with a familiar editor interface.[1]

Cursor's product expanded from completions and chat toward multi-file editing and tool-using agents. Anysphere announced its first agent-oriented proprietary model, Composer, in October 2025. Cursor 3.0 in April 2026 reorganized the interface around parallel agents, and Cursor Automations followed as a way to run cloud agents from schedules and service events.[6][10][16]

Financing and company-reported scale

Anysphere announced the following venture rounds. Valuations and operating metrics are company disclosures unless otherwise noted.

Date	Round	Amount and disclosed valuation	Source
October 2023	Seed	$8 million; $11 million total raised at that date	TechCrunch report based on company statements[1]
August 2024	Series A	$60 million	Anysphere announcement[17]
January 2025	Series B	$105 million	Anysphere announcement[18]
June 2025	Series C	$900 million at a $9.9 billion valuation	Anysphere announcement[19]
November 2025	Series D	$2.3 billion at a $29.3 billion post-money valuation	Anysphere announcement[20]

The company said in January 2025 that recurring revenue had exceeded $100 million. In June it reported more than $500 million in annual recurring revenue, and in November it said annualized revenue had passed $1 billion and that the product counted millions of developers. These figures were not presented with audited financial statements in the cited announcements and should be read as dated, company-reported milestones, not independent measurements or current forecasts.[18][19][20]

SpaceX partnership and pending merger

In April 2026, Anysphere announced a model-training partnership with SpaceX under which Cursor would use SpaceXAI's Colossus infrastructure. The announcement described additional compute for training Cursor's models but did not disclose a purchase of Anysphere.[21]

On June 16, 2026, SpaceX, its subsidiary X67 Inc., and Anysphere entered a definitive merger agreement. The SEC filing said X67 would merge into Anysphere and Anysphere would survive as a wholly owned SpaceX subsidiary. Anysphere shareholders would receive SpaceX Class A shares based on an implied Anysphere equity value of $60 billion. The transaction remained subject to closing conditions, including regulatory approvals, and SpaceX said it expected a third-quarter 2026 close. The agreement and expected timing should not be described as a completed acquisition.[22]

Plans and billing

Cursor's pricing documentation separated individual, team, and enterprise offerings. At the July 28, 2026 cutoff, it listed the following base prices:

Plan	Advertised base price	Notes
Hobby	Free	Limited individual use
Start	INR 649 per month, tax included	Individual plan available in India; included Cursor-model usage but no third-party-model pool
Pro	$20 per month	Included Cursor-model usage and at least $20 of third-party-model usage
Pro Plus	$60 per month	Larger included third-party-model pool
Ultra	$200 per month	Largest listed individual included-usage pool
Teams Standard	$40 per user per month	Central billing, team controls, shared features, and a Premium option
Enterprise	Custom	Sales-negotiated controls, support, and billing

The individual plans use separate pools for Cursor models and third-party models. Cursor says on-demand usage can continue after included usage is consumed on qualifying plans and is billed in arrears. Feature availability and limits differ among tiers, and Bugbot can generate separate usage charges. Except for the India-only Start price, listed prices exclude applicable taxes. Because plan names, regional offerings, model costs, and included quotas change, the live pricing page and account dashboard are the authoritative sources for a purchase decision.[14][23]

Data handling and privacy

Cursor's data-use overview distinguishes Privacy Mode from ordinary use. With Privacy Mode enabled, Cursor says customer data is not used to train its models and that its model-provider arrangements use zero data retention. It also notes an exception: providers may run abuse or risk classifiers, and content that triggers them may be retained for investigation under the provider's policy. Models without zero-data-retention treatment must be identified or require an administrator to opt in.[24]

When Privacy Mode is disabled, Cursor says it may use and store codebase data, prompts, editor actions, code snippets, and related activity to improve features and train models. Some inference providers may temporarily access and store inputs and outputs for inference improvement. Cursor's January 2026 terms separately state that Anysphere will not train, or allow a third party to train, on user content unless the user explicitly agrees. Organization customers may instead be governed by a negotiated master services agreement.[24][25]

All model requests, including requests that use a user's provider key, pass through Cursor's backend for prompt construction. Cursor says its zero-data-retention arrangement does not apply to bring-your-own-key requests, whose handling follows the chosen provider's policy. Repository indexing uploads chunks for embedding, and temporary encrypted caching may retain file contents during a request. Privacy Mode therefore concerns training and retention conditions; it does not mean that code never leaves the local computer. Users handling regulated, confidential, or third-party code should review the current policy, provider treatment, workspace settings, and any organization agreement before enabling features.[15][24][25]

Security

Agent risk and operational controls

Cursor's terms warn that machine-generated suggestions may be erroneous or misleading and assign responsibility for evaluating them to the user. The terms also describe an optional auto-code-execution feature and state that enabling it can expose the user to outages, defects, data loss, and security vulnerabilities. These risks are not unique to Cursor, but they are more consequential when an agent can modify files, run commands, access secrets, use MCP tools, or write to a remote repository.[25]

Practical controls include using current client versions, keeping command approval enabled where feasible, granting least-privilege repository and service access, isolating untrusted work, restricting outbound network access, excluding production credentials, reviewing diffs, running tests and static analysis, and requiring accountable review before deployment. These controls reduce exposure but do not prove generated code is correct or secure.[7][13][25][27][28][29]

Anysphere's security page says a SOC 2 Type II attestation report and the executive summary of its latest penetration test are available on request through its trust portal. It also says the company conducts third-party penetration testing at least annually. These are vendor security statements, not a guarantee that every deployment, extension, model, or agent action is safe.[26]

Published advisories

Cursor's public GitHub repository lists patched high-severity advisories. The affected ranges below describe old versions, not current unfixed behavior:

Advisory	Affected versions	Patched version	Documented condition
CVE-2025-61590	Earlier than 1.7	1.7	Prompt injection could cause an agent to modify a `.code-workspace` file and reach code execution; the patch treated that extension as sensitive.[27]
CVE-2025-64107	1.7.52 on Windows	2.0	Backslash path manipulation could bypass sensitive-file approval and required a prompt-injection or malicious-model chain.[28]
CVE-2026-22708	2.2 and earlier	2.3	In non-default Auto-Run plus Allowlist mode, environment-variable manipulation could bypass the terminal allowlist when chained with prompt injection or a malicious model.[29]

The advisories illustrate why an agent's natural-language instructions cannot be its only security boundary. Updating the client, minimizing automatic execution, and constraining tool permissions remain important even when a reported vulnerability has been patched.[27][28][29]

Research on productivity and code quality

Two studies available by the cutoff examined Cursor in substantially different settings. Neither tested every Cursor version, model, workflow, user population, or repository type.

Study	Design	Main result	Important limits
METR, 2025	Randomized controlled trial with 16 experienced open-source developers completing 246 tasks in mature repositories they knew well; the AI-allowed condition primarily used Cursor Pro with Claude 3.5 or 3.7 Sonnet	AI access increased measured completion time by 19 percent. Participants had predicted a 24 percent reduction before tasks and estimated a 20 percent reduction afterward.	Tools were from February through June 2025; tasks concerned mature open-source projects; only 44 percent of participants had used Cursor before; the sample was small and deliberately specialized.[30]
He et al., MSR 2026	Difference-in-differences analysis of 806 GitHub repositories whose committed `.cursorrules` files served as an adoption proxy, matched to 1,380 control repositories	The study estimated a 281.3 percent first-month increase in lines added and 48.4 percent in month two, with no significant velocity gain after two months. Across the post-adoption period it estimated 30.3 percent more static-analysis warnings and 41.6 percent greater code complexity.	Adoption and continued use were not directly observed; model and Cursor versions were unknown; unobserved confounding and use of other AI tools could remain; results may not generalize beyond public repositories or the studied JavaScript, TypeScript, and Python projects.[31]

The METR trial directly randomized access but measured a narrow population using early-2025 tools on familiar repositories. The MSR study covered more projects and a longer period but inferred use from a committed configuration file and remained observational. Lines added are an output-volume measure, not a direct measure of useful functionality, and static-analysis warnings and code complexity are imperfect proxies for maintainability. The studies support measuring outcomes in the intended workflow rather than assuming that model benchmarks or user perceptions translate into faster or higher-quality engineering.[30][31]

Responsible use

Cursor can search code and perform multi-file edits, but the software does not transfer responsibility from the person or organization shipping the result. Cursor's terms require users to evaluate generated suggestions. A sound workflow limits access, reviews changed files, runs appropriate tests and security analysis, and requires accountable approval before deployment.[5][25]

Cursor's published advisories show that direct or indirect prompt injection can be chained with file- or command-control weaknesses. The risk is especially relevant when workflows process external content while holding repository, tool, or network access, so least privilege and isolation remain important.[7][10][27][28][29]

Alternatives

Other AI coding products expose different combinations of editor completion, chat, command-line agents, cloud execution, and code review. GitHub Copilot combines in-editor suggestions, chat, command-line help, and pull-request workflows; Claude Code is available in terminals, IDEs, a desktop app, and a browser; and Windsurf is another AI-focused code editor.[32][33][34] Comparing them requires a dated test on the same tasks, repositories, models, policies, and cost assumptions. Vendor demonstrations and benchmarks are not interchangeable with that evaluation.

See also

References

Kyle Wiggers, Anysphere raises $8M from OpenAI to build an AI-powered IDE, TechCrunch, October 11, 2023. https://techcrunch.com/2023/10/11/anysphere-raises-8m-from-openai-to-build-an-ai-powered-ide/
Cursor Documentation, VS Code Migration. https://cursor.com/docs/configuration/migrations/vscode
Cursor Documentation, Tab completion. https://cursor.com/help/ai-features/tab
Cursor Documentation, Inline edit. https://cursor.com/help/ai-features/inline-edit
Cursor Documentation, Cursor Agent overview. https://cursor.com/docs/agent/overview
Cursor, Cursor 3.0: New Cursor Interface, April 2, 2026. https://cursor.com/changelog/3-0
Cursor Documentation, Cloud Agents. https://cursor.com/docs/cloud-agent
Cursor Documentation, Cursor for iOS. https://cursor.com/docs/cloud-agent/mobile
Cursor Documentation, Using Agent in CLI. https://cursor.com/docs/cli/using
Jack Pertschuk, Jon Kaplan, and Josh Ma, Build agents that run automatically, Cursor, March 5, 2026. https://cursor.com/blog/automations
Cursor Documentation, Rules. https://cursor.com/docs/rules
Cursor Documentation, Prompting. https://cursor.com/docs/agent/prompting
Cursor Documentation, Model Context Protocol. https://cursor.com/docs/mcp
Cursor Documentation, Models and Pricing. https://cursor.com/docs/models-and-pricing
Cursor Documentation, Bring your own API key. https://cursor.com/help/models-and-usage/api-keys
Cursor Team, Composer: Building a fast frontier model with RL, October 29, 2025. https://cursor.com/blog/composer
Cursor Team, Series A and Magic, August 22, 2024. https://cursor.com/blog/series-a
Cursor Team, Series B and Automating Code, January 16, 2025. https://cursor.com/blog/series-b
Cursor Team, Series C and Scale, June 6, 2025. https://cursor.com/blog/series-c
Cursor Team, Past, Present, and Future, November 13, 2025. https://cursor.com/blog/series-d
Cursor Team, Cursor partners with SpaceX on model training, April 21, 2026. https://cursor.com/blog/spacex-model-training
Space Exploration Technologies Corp., Form 8-K, Item 1.01, June 16, 2026. https://www.sec.gov/Archives/edgar/data/1181412/000162828026043411/spaceexplorationtechnologi.htm
Cursor, Pricing. https://cursor.com/pricing
Cursor, Data Use and Privacy Overview, updated July 15, 2026. https://cursor.com/data-use
Anysphere, Terms of Service, updated January 13, 2026. https://cursor.com/en-US/terms-of-service
Cursor, Security, updated April 24, 2026. https://cursor.com/en-US/security
Cursor, RCE via .code-workspace files using Prompt Injection, GHSA-xg6w-rmh5-r77r, CVE-2025-61590, October 2, 2025. https://github.com/cursor/cursor/security/advisories/GHSA-xg6w-rmh5-r77r
Cursor, Sensitive File Protection Bypass on Windows, GHSA-2jr2-8wf5-v6pf, CVE-2025-64107, November 3, 2025. https://github.com/cursor/cursor/security/advisories/GHSA-2jr2-8wf5-v6pf
Cursor, Terminal Tool Allowlist Bypass via Environment Variables, GHSA-82wg-qcm4-fp2w, CVE-2026-22708, January 14, 2026. https://github.com/cursor/cursor/security/advisories/GHSA-82wg-qcm4-fp2w
Joel Becker, Nate Rush, Beth Barnes, and David Rein, Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity, METR, July 10, 2025. https://metr.org/Early_2025_AI_Experienced_OS_Devs_Study-paper.pdf
Hao He, Courtney Miller, Shyam Agarwal, Christian Kastner, and Bogdan Vasilescu, Speed at the Cost of Quality: How Cursor AI Increases Short-Term Velocity and Long-Term Complexity in Open-Source Projects, Proceedings of the 23rd International Conference on Mining Software Repositories, 2026. https://doi.org/10.1145/3793302.3793349
GitHub Documentation, What is GitHub Copilot? https://docs.github.com/en/copilot/get-started/what-is-github-copilot
Anthropic Documentation, Claude Code overview. https://code.claude.com/docs/en/overview
Windsurf, Switch from Cursor, product overview. https://windsurf.com/switch/cursor

Editing: Cursor (code editor)