1 min lesson
The surface you'd protect
Use "Cursor's product reads, writes and executes code on customer machines and in the cloud" to describe the practical rule.
Step 1 of 3
Cursor's product reads, writes and executes code on customer machines and in the cloud. That single fact creates a security surface that off-the-shelf playbooks don't cover.
Read this section as the role contract. The diagram or table names the surface area, but the interview signal is whether you can turn it into a clear operating claim: what you own, what you do not own, what evidence proves the work is working and where judgment matters.
Hold four layers in your head, each with its own attacker and its own paved-road defense. The agent layer is the one most candidates underweight and it's the one the interview will press hardest.
Learn more
Full explanation
The Surface as a Stack
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
Four layers, one engineer. The agent layer is the novel one off-the-shelf playbooks don't cover. Step through for the attacker and the paved road on each.
Learn more
Advanced table
Different attacker, different defense per layer
Different attacker, different defense per layerthe table to memorize
- Layer
- Product / editor
- Lead threat
- Untrusted repo content executing or injecting
- Paved-road defense
- Treat repos as untrusted input; sandbox extensions; no auto-run of repo commands
- Layer
- Cloud / infra
- Lead threat
- Credential compromise, standing over-permission
- Paved-road defense
- Least-privilege + JIT access; secret scanning; key rotation; mTLS between services
- Layer
- Agent
- Lead threat
- Prompt injection, tool abuse, sandbox escape
- Paved-road defense
- Hard isolation boundary; tool allowlists; confirmation on destructive actions
- Layer
- Customer data
- Lead threat
- Exfiltration, inappropriate retention, weak tenancy
- Paved-road defense
- Privacy modes; retention caps; tenant isolation; access-only audit logs
| Layer | Lead threat | Paved-road defense |
|---|---|---|
| Product / editor | Untrusted repo content executing or injecting | Treat repos as untrusted input; sandbox extensions; no auto-run of repo commands |
| Cloud / infra | Credential compromise, standing over-permission | Least-privilege + JIT access; secret scanning; key rotation; mTLS between services |
| Agent | Prompt injection, tool abuse, sandbox escape | Hard isolation boundary; tool allowlists; confirmation on destructive actions |
| Customer data | Exfiltration, inappropriate retention, weak tenancy | Privacy modes; retention caps; tenant isolation; access-only audit logs |
The interview tests whether you can name the attacker per layer, not just list controls. The lead-threat column is the part that signals threat-modeling instinct.
Don't collapse all four layers into "web AppSec." A candidate who only talks OWASP Top 10 misses the agent and customer-data layers entirely, which are the surfaces unique to Cursor and the reason this role exists. The editor opening a repo is an untrusted-input problem, not a feature.
QWhy is the agent layer the security surface that off-the-shelf playbooks don't cover and what's its lead threat?