Cursor Enterprise: LLM Safety & Controls

Language models generate text from probability distributions. They don't retrieve facts or run deterministic logic. The same input can produce different outputs, a model can write plausible code that is wrong, and a crafted prompt can steer it, which is called prompt injection. Cursor's answer is to combine two layers instead of trusting the model to behave.

These controls hold whatever the model proposes. For terminal commands, Cursor's LLM safety page gives two defaults. Its terminal section says Cursor asks for your approval before every terminal command and shows the full command, so you can approve, deny or modify it. Its Run Mode section, like the run-modes page, says Auto-review is the default from Cursor 3An older release label for Cursor's multi-agent interface; current product guidance calls the active surface the Agents Window. Press Enter for the full definition..6. Auto-review runs some calls without asking: allowlisted calls, commands that run in the sandbox, and calls its classifier allows.

Hooks run your own logic at fixed points in the agent loop, and the ones that fire before an action can block it. That makes hooks the place for rules that must hold: block raw git commands, require approval for sudo, block database DROP statements, or scan prompts for secrets before they are sent.

Cursor's LLM safety page names the checkpoints and what to check at each one:

For data loss prevention (DLP), Cursor documents three integration paths. An endpoint DLP agent can inspect Cursor's network traffic: point it at the *.cursor.sh domains to scan outbound requests and block or alert on violations. Hooks-based DLP runs your own scanning inside the agent loop. The third path calls your existing DLP vendor's API from a hook, which keeps one policy across all your development tools.

Hooks fire at defined points in the agent loop, not whenever the model chooses. A hook that fires before an action runs first and can stop it. A hook that fires after an action sees the result, but the step has already happened. The table maps the checkpoints on Cursor's LLM safety page to hook events. The hooks reference documents more, including hooks around MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool calls.

Cursor's pages disagree about the code-generation checkpoint. The LLM safety page says generated code is scanned before it is written to disk. The hooks reference describes afterFileEdit as running once the agent has edited a file, and it lists no output that blocks the edit. Treat that scan as a check after the fact, and keep blocking checks in the before-hooks.

Cursor's sandbox limits what a terminal command can reach on your machine. It applies to shell commands, and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. calls and other tool calls run outside it. Under Auto-review, shell commands that aren't allowlisted run in the sandbox when they can. Under Allowlist the sandbox is optional, and Run Everything doesn't use it.

Commands that need more access, such as full network access, writes outside the workspace or privileged operations, can't use the sandbox. Under Auto-review they go to the classifier instead. Reads outside the workspace are allowed by default. Setting Read Access to Workspace makes the agent ask before it reads anything outside.

Read the stack from the top. Allowlists set which models and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. servers are permitted at all, and hooks catch a permitted action used the wrong way. The terminal sandbox contains a command that gets past a hook. The last layer moves the agent off the laptop: a Cloud Agent runs on its own dedicated machine, so a command that gets past every other layer does its damage there.

On Enterprise, admins can set model access, cloud-distributed hooks and sandbox policy for the whole organization, so those layers don't depend on each developer's settings.

Partly. Cursor's LLM safety page says every model provider (OpenAI, Anthropic, Google and SpaceXAI) runs safety systems that filter harmful content. They reject prompts that ask for harmful information, refuse to generate dangerous code and filter outputs. Cursor works with providers so models meet safety standards before they reach users, and providers keep evaluating models for safety issues.

Security controls block a harmful action after the model suggests it. Steering shapes the suggestion in the first place. Because steering is non-deterministic, it improves outcomes without guaranteeing prevention, so back anything that must hold with an enforcement hook.