1 min lesson
CI gates as paved-road controls
Respond to "Why does an autonomous coding agent change the supply-chain threat model and what control would you build at Cursor?" Name the reason and the detail behind it.
Step 1 of 2
CI gates as paved-road controlsmake the secure path the default path
The builder-first move is to encode these checks so engineers never have to remember them. Secret scanning and dependency audit run in CI; a finding blocks the merge. The developer gets a clear message at the moment they can fix it, not a ticket three weeks later.
- run: gitleaks detect --no-banner # block committed secrets - run: pip-audit --strict # block known-vuln deps - run: cosign verify $IMAGE # only signed artifacts deploy
When an AI agent writes code, it can confidently import or npm install a package that doesn't exist - a hallucinated dependency. Attackers watch for common hallucinated names and register them ("slopsquatting"), so the next agent that suggests that package installs malware. This is squarely Cursor's threat model: an agent suggesting dependencies is a supply-chain decision. Defenses are an allowlist of approved packages, resolving against a curated internal registry and a CI gate that fails on any package not seen before a human approves it.