1 min lesson
Why AI agents are a new surface
Put this lesson point into plain words: "An autonomous coding agent reads your repo, writes files and runs commands on your machine."
Step 1 of 2
An autonomous coding agent reads your repo, writes files and runs commands on your machine. The clean line every classic security model draws - between data the system processes and code the system trusts - is gone. The data IS the instructions now.
This is the round that separates a Cursor security interview from any other. The work spans web vulns, cloud IAM and crypto, but the part interviewers will probe hardest is the one no off-the-shelf playbook covers: the threat model of an agent that acts on the user's system. Cursor builds exactly that product and it secures its own codebase the same way, so vague answers get caught fast.
Start by naming the shift cleanly. A traditional app has a fixed set of code paths an attacker tries to subvert with crafted input. An agent has an open-ended action space driven by a model and the model treats almost everything it reads as potential instruction.
Learn more
Advanced table
Reference table
- Assumption in classic appsec
- Code and data are separate; input is parsed, not executed
- What the agent breaks
- Model context mixes trusted system prompt, user intent and untrusted file/web content in one stream
- Assumption in classic appsec
- The set of operations is fixed and reviewable
- What the agent breaks
- The agent chooses actions at runtime - which file to edit, which command to run, which tool to call
- Assumption in classic appsec
- Trust boundaries sit at the network and process edges
- What the agent breaks
- A new boundary sits inside the model loop: between what the user asked for and what the content told the model to do
- Assumption in classic appsec
- An exploit needs a bug in your code
- What the agent breaks
- An exploit can be plain English embedded in a README, a web page or a tool's output
| Assumption in classic appsec | What the agent breaks |
|---|---|
| Code and data are separate; input is parsed, not executed | Model context mixes trusted system prompt, user intent and untrusted file/web content in one stream |
| The set of operations is fixed and reviewable | The agent chooses actions at runtime - which file to edit, which command to run, which tool to call |
| Trust boundaries sit at the network and process edges | A new boundary sits inside the model loop: between what the user asked for and what the content told the model to do |
| An exploit needs a bug in your code | An exploit can be plain English embedded in a README, a web page or a tool's output |
The interviewer wants to hear that you see the boundary move inside the model loop.
Learn more
Optional practice
Practice: Why AI agents are a new surface
QAn interviewer asks: "What's fundamentally different about securing a coding agent versus a normal web service?" Give the crisp answer.