Enterprise
Cursor Enterprise: LLM Safety & Controls
You can't rely on an LLM to always make safe decisions. Cursor splits agent safety into two layers: deterministic security controls that block dangerous operations regardless of what the model suggests (run modes, enforcement hooks, .cursorignore, sandboxing) and non-deterministic steering that guides the model toward better behavior (rules, commands, MCP). Use both: controls are the safety net, steering reduces how often agents reach for trouble.
On this page
- Why can't you just trust the model to behave?
- What deterministic controls block dangerous agent actions?
- How do hooks enforce policy and connect DLP tools?
- When do hooks fire, and what makes them trustworthy?
- What does Sandbox Mode contain?
- Do the model providers' own safety systems protect us?
- How does steering guide the model toward better behavior?
Why can't you just trust the model to behave?
LLMs generate text from probability distributions, not by retrieving facts or running deterministic logic. The same input can produce different outputs, the model can hallucinate plausible-but-wrong code, and a crafted prompt can steer it (prompt injection). So you don't trust the model to police itself. You wrap it in two layers that work together.
- Security controls
- Deterministic enforcement. Hard boundaries that block dangerous operations whatever the LLM suggests: terminal restrictions, hooks, approval workflows, sandboxing. Your primary defense.
- LLM steering
- Non-deterministic guidance. Shapes the model's context and available actions: rules, commands, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition.. Improves quality but does not guarantee prevention.
Security controls are the safety net; steering reduces how often agents attempt problematic actions in the first place. Steering alone is not a security boundary. Rules are suggestions the model tries to follow rather than guarantees.
This exact topic is a hands-on lesson: Model, MCP, Integration and Safety Controls — about 6 minutes, free to read.
What deterministic controls block dangerous agent actions?
These controls enforce hard boundaries and work regardless of what the model proposes. By default Cursor requires your approval before running any terminal command, so you see the full command and can approve, deny or modify it before it runs.
- Control
- Run modes
- What it enforces
- In Cursor 3Cursor's agent-forward interface (also called the agent window or Glass), built to run and supervise many agents at once rather than edit one file. Press Enter for the full definition..6+, end users pick Auto-review (default), Allowlist or Run Everything. Auto-review runs allowlisted calls, sandboxes shell commands when it can, and routes the rest through an LLM classifier that returns allow or block.
- Control
- Enforcement hooks
- What it enforces
- Custom logic at points in the agent loop: before prompt submission, before file reading, after code generation and before terminal execution (to scan, redact or block).
- Control
- .cursorignoreA file listing paths Cursor must never index or read, kept separate from .gitignore. Press Enter for the full definition.
- What it enforces
- Excludes files from semantic search, agent file reading and context selection. Like .gitignore, but for what Cursor can access.
- Control
- .cursor directory protection
- What it enforces
- Enterprise teams can stop agents from modifying or deleting the .cursor/ directory and its rules and settings.
- Control
- Browser origin controls
- What it enforces
- Enterprise teams allowlist which websites the browser tool may navigate to; other origins are blocked.
- Control
- Sandboxing
- What it enforces
- Stronger isolation via Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. (a separate VM), file system permissions, or a dedicated dev machine.
| Control | What it enforces |
|---|---|
| Run modes | In Cursor 3Cursor's agent-forward interface (also called the agent window or Glass), built to run and supervise many agents at once rather than edit one file. Press Enter for the full definition..6+, end users pick Auto-review (default), Allowlist or Run Everything. Auto-review runs allowlisted calls, sandboxes shell commands when it can, and routes the rest through an LLM classifier that returns allow or block. |
| Enforcement hooks | Custom logic at points in the agent loop: before prompt submission, before file reading, after code generation and before terminal execution (to scan, redact or block). |
| .cursorignoreA file listing paths Cursor must never index or read, kept separate from .gitignore. Press Enter for the full definition. | Excludes files from semantic search, agent file reading and context selection. Like .gitignore, but for what Cursor can access. |
| .cursor directory protection | Enterprise teams can stop agents from modifying or deleting the .cursor/ directory and its rules and settings. |
| Browser origin controls | Enterprise teams allowlist which websites the browser tool may navigate to; other origins are blocked. |
| Sandboxing | Stronger isolation via Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. (a separate VM), file system permissions, or a dedicated dev machine. |
Configure .cursor directory protection and browser controls in the team dashboard (Enterprise only).
The run-mode allowlist is best-effort. A determined agent or prompt injection might bypass it, so always pair it with hooks. .cursorignoreA file listing paths Cursor must never index or read, kept separate from .gitignore. Press Enter for the full definition. is a convenience feature, not a boundary: users can still open ignored files manually and it only excludes from indexing. For true protection, use file system permissions or encrypt the data.
Cursor agents run on your local machine by default and can read, write, execute and reach the network exactly as your user account can. If your account can delete files, the agent can too (with approval by default). Enabling auto-approval removes the review step: destructive commands or prompt injection could run before you see them.
How do hooks enforce policy and connect DLP tools?
Hooks run your own logic at key points in the agent loop and can return a deny decision. That makes them the place to enforce requirements the model must follow: blocking raw git commands, requiring approval for sudo, blocking database DROP statements, or scanning prompts and generated code for secrets before they leave or land on disk.
Hooks stop the shell before it runs
0:26 · narratedRead this demo as text
- Ask the agent to run rm -rf on a temp directory. A Rule might say please don't. That is not enough.
- Rejected before the shell ran. The deny-rm hook fired. Change that gate in Cursor Settings, Hooks — not by hoping the model remembers.
Practice next: Practice this yourself in the hands-on module.
Simulated Cursor 3.12 (macOS, light) — beta educational reconstruction, not the real product.
- Before prompt submission: scan prompts for API keys, credentials or PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. and block submissions that contain them.
- Before file reading: redact or block access to config files with secrets, PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. in logs, or proprietary algorithms.
- After code generation: scan generated code for vulnerabilities (SQL injection, XSS), risky licensed code, or hardcoded credentials before it is written.
- Before terminal execution: block dangerous commands or route them through an approval workflow.
For Data Loss Prevention, Cursor documents three integration paths. Endpoint DLP agents inspect Cursor's network traffic: point your DLP at the *.cursor.sh domains to scan or block outbound requests. Hooks-based DLP runs custom scanning in the agent loop. Third-party DLP integration calls your existing vendor's API from a hook so one policy covers every development tool.
You can make the agent ask before every read, edit, command or network request. In practice this is tedious because agents take many steps per task, so most teams use hooks to block dangerous operations automatically instead.
When do hooks fire, and what makes them trustworthy?
Hooks fire at defined points in the agent loop, not whenever the model feels like it. Each event corresponds to a moment where the agent is about to do something you may want to inspect or stop. The script you attach runs first and decides whether the step proceeds.
- Lifecycle event
beforeSubmitPrompt- Fires when
- Right before a prompt goes to the model.
- What you do there
- Scan the prompt for secrets or PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. and block submission if it is dirty.
- Lifecycle event
beforeReadFile- Fires when
- Before the agent reads a file into context.
- What you do there
- Redact or deny access to config, logs or proprietary source.
- Lifecycle event
beforeShellExecution- Fires when
- Before a terminal command executes.
- What you do there
- Block destructive commands or route them through an approval workflow.
- Lifecycle event
afterAgentResponse- Fires when
- After the model returns code or a response.
- What you do there
- Scan generated output for vulnerabilities or hardcoded credentials before it lands.
| Lifecycle event | Fires when | What you do there |
|---|---|---|
beforeSubmitPrompt | Right before a prompt goes to the model. | Scan the prompt for secrets or PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. and block submission if it is dirty. |
beforeReadFile | Before the agent reads a file into context. | Redact or deny access to config, logs or proprietary source. |
beforeShellExecution | Before a terminal command executes. | Block destructive commands or route them through an approval workflow. |
afterAgentResponse | After the model returns code or a response. | Scan generated output for vulnerabilities or hardcoded credentials before it lands. |
Each event is a fixed checkpoint in the loop; your script runs synchronously and returns allow or deny.
A hook is a deterministic script you write, own and check into the repo. It does not depend on the model deciding to behave. The same input produces the same allow-or-deny result every time, and you can read, test and version it like any other code. That is what makes it a boundary rather than a suggestion.
When a hook is deployed through MDM at the enterprise level, it takes precedence over any hook an individual user has configured. A developer cannot weaken or remove an org policy by editing their own local hook. The managed configuration wins.
What does Sandbox Mode contain?
Sandbox ModeAn isolated agent execution mode that contains the blast radius: file access scoped to the workspace, network off by default and git restricted to read-only, enforceable org-wide. Press Enter for the full definition. shrinks the blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. of an agent that goes wrong. Instead of trusting the model not to reach for something dangerous, it removes the reach. The agent operates inside a confined environment where the things that cause real damage are simply not available.
- File access
- Scoped to the workspace. The agent cannot read or write outside the project directory.
- Network access
- Off by default, so the agent cannot reach external services or exfiltrate data unless you explicitly allow it.
- Git
- Read-only. The agent can inspect history but cannot push, and a force-push that rewrites shared history is blocked.
Sandbox ModeAn isolated agent execution mode that contains the blast radius: file access scoped to the workspace, network off by default and git restricted to read-only, enforceable org-wide. Press Enter for the full definition. is set as an organization policy, so a single developer cannot turn it off to move faster. The confinement holds whether or not the person at the keyboard wants it, which is what makes it a real control rather than a setting people quietly opt out of.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
Hooks, model and MCP control, and Sandbox Mode layer on the privacy foundation. Each contains a blast radius the others can't, and each is enforced org-wide.
Read the stack top to bottom, each layer assuming the one above it can fail. The Model / MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. allowlist sets which models and MCP servers are permitted at all. Hooks catch a permitted-but-misused action the allowlist can't express. The terminal sandbox contains a command that slips past a hook. VM isolation via Cloud AgentsAgents that run in a Cursor-managed virtual machine, check out the repo, do the work and open a pull request, then shut down, with no load on your laptop. Press Enter for the full definition. (Cursor 3Cursor's agent-forward interface (also called the agent window or Glass), built to run and supervise many agents at once rather than edit one file. Press Enter for the full definition..5) is the last boundary if the sandbox itself is compromised. The damage stays in a disposable box. Each layer is set org-wide, so none depends on the individual developer keeping it on.
Do the model providers' own safety systems protect us?
Every provider (OpenAI, Anthropic, Google, xAI) runs safety systems that reject harmful prompts, refuse dangerous code and filter outputs. Cursor works with providers so models meet safety standards before they reach users, and providers keep evaluating models for issues.
These systems can be bypassed or tricked. Treat them as one more layer, not the wall. Always implement your own controls through hooks and access policies.
How does steering guide the model toward better behavior?
Security controls block harmful actions after the model suggests them. Steering shapes the suggestions in the first place. It is non-deterministic (it improves outcomes but doesn't guarantee prevention), so pair anything that must hold with an enforcement hook.
- Rules
- Instructions added to the model's context before every request. Scoped as user, project or team rules. Use team rules for company-wide security or compliance standards. The model tries to follow them; they are not guarantees.
- Commands & workflows
- Reusable prompts invoked with slash commandsSaved multi-step prompts you trigger from the / menu, such as run tests, fix CI or open a pull request. Press Enter for the full definition. like /test or /deploy. A /security-review command can walk the agent through scanning for SQL injection, exposed secrets and input sanitization. Team admins create org-wide commands.
- MCP servers
- Model Context Protocol servers give agents access to external data: docs, internal APIs, knowledge bases. MCPs enrich context but do not enforce policy; unlike hooks, they inform rather than block.
Frequently asked questions
Is .cursorignore a security boundary?
No. It excludes files from semantic search, agent file reading and context selection, but users can still open ignored files manually and it only affects indexing. For real protection use file system permissions or encrypt the data, and add hooks to scan or block access.
Are Cursor agents sandboxed from my machine?
Not by default. Agents run locally with the same access as your user account: they can read, write, execute and reach the network as you can. For stronger isolation, run Cursor in a separate VM via Cloud Agents, restrict the process with file system permissions, or use a dedicated development machine.
Can rules force the model to follow our security standards?
Rules steer the model but don't guarantee compliance. They are instructions it attempts to follow. For requirements that must hold, combine team rules with enforcement hooks that deterministically block the disallowed operation.
When do hooks actually run?
At fixed points in the agent loop: beforeSubmitPrompt, beforeReadFile, beforeShellExecution and afterAgentResponse. Each event is a checkpoint where your script runs synchronously and returns allow or deny. Because a hook is deterministic code you own and check into the repo, the enforcement layer is your code and your policy, not the model's judgment.
Can a developer override an enterprise hook or turn off Sandbox Mode?
No. Hooks deployed through MDM at the enterprise level take precedence over a user's local hooks, and Sandbox Mode is enforced as an org-level policy that an individual cannot disable. Sandbox Mode scopes file access to the workspace, keeps network access off by default, and restricts git to read-only so a force-push that rewrites shared history is blocked.
Sources & last verified
- Cursor - LLM Safety & Controls
- Cursor - Hooks
- Cursor - Run Modes
- Cursor - Agent Security
- Cursor - Ignore Files
- Cursor - Rules
- Cursor - MCP
Cursor ships frequently. Last updated June 25, 2026.
Keep reading
Rather do it than read about it? Run 11 interactive Cursor walkthroughs in a simulated editor. Free, no account needed.