Cursor Cloud Agent Security and Network Access, Explained

Secrets provided to Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. are encrypted at rest and in transit, and no one other than the Cloud Agent user can see them. You decide how exposed each secret is by setting its type:

Runtime Secret redaction is narrower than the name suggests. The value stays in the process environment, which is how your test suite can authenticate at all. What gets replaced with [REDACTED] is the copy that would otherwise land in tool-call results, the chat transcript, commits and commit messages. Treat the type as a control on what gets written down, and assume anyone who can open a Terminal in that environment can read the value.

Two controls cover provenance and access, and neither needs per-agent setup.

A signature proves where a commit came from, not that anyone reviewed it. A branch rule that checks only for a signature passes Cloud Agent PRs with no extra configuration, so it has not reviewed anything on your behalf. Of the two controls, we think Protected Git Scopes changes your exposure more, because it decides who can start an agent on those repositories at all.

Cursor lists six things you should know about how Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. run, and several of them describe risks you take on by running one:

• Grant read-write privileges to Cursor's GitHub app for the repos you want to edit; Cursor uses this to clone the repo and make changes.
• Your code runs inside Cursor's AWS infrastructure in isolated VMs and is stored on VM disks while the agent is accessible.
• The agent has internet access by default; you can configure network egress controls for users, teams, and saved environments to restrict the domains it can access.
• The agent auto-runs all terminal commands so it can iterate on tests, unlike the foreground agent, which requires approval for every command. Auto-running introduces data exfiltration risk: an attacker could use a prompt injection attack to trick the agent into uploading code to a malicious site.
• If Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. is disabled, Cursor collects prompts and dev environments to improve the product.
• If you disable Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. when starting a cloud agent and then enable it mid-run, the agent continues with Privacy Mode disabled until it completes.

The auto-run item carries the most risk, because running every command is also what a prompt injection needs to get code out of the VM. Cursor's Run Modes page says the same of Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition.: Run Modes apply to local agents, and a Cloud Agent runs inside its own dedicated machine, so it never asks you to approve an action.

The two pages describe local agents differently. The security page says a foreground agent asks before every command. On the Run Modes page, a local agent's mode decides which commands run without asking, and Run Everything runs every tool call automatically.

The network access modes further down address the Cloud Agent risk. They limit where code can go once a command runs.

Every run stores two kinds of data, and each follows its own retention rule.

The Delete Agent API removes a cloud agent's conversation transcript and its artifacts on demand. It doesn't delete environment snapshots, which can't be deleted on demand and follow the 30-day window instead. Plan around the snapshot: it is a copy of the VM disk, and it outlives the agent you deleted. If a credential ever reached that disk, rotate it instead of waiting out the window.

By default, Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. reach the internet. You control outbound traffic with one of three access modes, which users, saved environments and team admins set from the Cloud Agents dashboard. The modes apply to Cursor-hosted Cloud Agents, while runs on Self-Hosted Machines use the machine's own network, firewall and proxy.

We suggest starting on Default + allowlist, whose default domains are the ones the desktop agent's sandbox uses, and tightening once you know the host list. Allowlist only is tempting because you write its whole boundary yourself, but it breaks first. Beyond your list, only a small set of domains stays reachable, Cursor's own services and SCM providers among them. Whatever your install step fetches fails until you add it, and a wildcard becomes the easy fix.

The environment wins, then the user, then the team default, and each level can set its own mode and allowlist. A user-level setting applies to every Cloud Agent you create. A saved environment can set a mode outright, or inherit the user or team setting and optionally add an environment allowlist. That lets a production-adjacent environment run Allowlist only while the rest stay on Default + allowlist. The team-level allowlist is also the sandbox default network allowlist, so one list covers both.

Precedence matters more as a team grows. On a small team, everyone sets their own mode and a mistake gets fixed by asking. On a larger one, a team default is only a default, because a member who already set a preference keeps it. An admin who switches the team to Allowlist only has changed things only for people who never configured a setting of their own.

Lock Network Access Policy makes the team setting apply to every member's Cursor-hosted agents, and locking is Enterprise-only. When a run fails on network access, check which scope applied before you edit anything. Changing a level that didn't apply leaves the run failing the same way.

No. Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. do not need to run on your hardware, and your private services do not need to accept inbound traffic from the public internet. For a service in a VPC or intranet, run Tailscale userspace networking, Cloudflare Tunnel, or a similar private-network client inside the agent environment. The agent connects out through an authenticated path while the service stays where it is.

The right client depends on the target. Cloudflare Tunnel fits a service you can reach through an authenticated HTTPS hostname, because the agent then calls that hostname like any other external URL and you allowlist it the same way. For TCP targets such as private databases, use a tunnel client that exposes a local TCP listener and point the agent at localhost instead.

Enterprise teams with private GitHub Enterprise Server or GitLab Enterprise can use private connectivity with AWS PrivateLinkAn AWS connection Cursor uses for private Git provider and repository-origin traffic; it does not cover model-provider traffic. Press Enter for the full definition. or Cloudflare Tunnel. The setup guide covers the Tailscale flags and where to store Cloudflare Access tokens.

You don't need to self-host the runtime to reach a private database. My Machines and Team Pools are for owning the machine that runs tool calls, which is a different problem. Choose where cloud agents run has that comparison.

Outbound connections from Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. come from specific IP ranges. Cursor publishes them in CIDR notation through a JSON API endpoint, so you can allowlist them on firewalls if needed. Fetch them with curl https://cursor.com/docs/ips.json, which returns these fields:

Watch modified, because it is the only signal in the payload that the ranges moved. A firewall rule built from a single curl can keep passing review long after it stopped matching what Cursor uses.

The git egress proxy carries only git traffic. Other requests from the agent, including GitHub API calls and gh, come from the Cloud Agent ranges. Teams that use Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. alongside Origin add a further list of IPs on top of the proxy addresses. Cursor calls that list stable and gives teams on IP allow lists advance notice before any address is added or removed.