Cursor Auto-review: Replacing Approval Fatigue with a Classifier Agent for AI Coding

Forum topic · QianXun · 2026-06-12

Summary

Cursor published an engineering blog post on June 11 introducing Auto-review, a classifier agent that reviews tool calls before execution to address "approval fatigue" in agentic development. Instead of asking users to approve or reject every risky action, a dedicated classifier agent runs inside the agent's main loop, checking context via tools like ReadFile, Grep, Glob, and ListDir. Low-risk actions pass through; high-risk or intent-divergent ones are blocked, with an explanation returned to the parent agent, which autonomously adjusts—switching tools, narrowing scope, or bypassing the risky step. Users are interrupted only when the agent cannot converge on a safe path. Cursor reports a ~4% interception rate and ~7% of conversations triggering interruptions, versus up to 40% under some enterprise full-blocking setups. The classifier was trained on 6,122 labeled lines from internal dev sessions plus synthetic data, evaluated on the full production pipeline, with decision stability (consistent results across 6 runs) as a key metric. Together with recent Bugbot speed and cost improvements, the post signals Cursor building safety infrastructure for the agent era.

On June 11, Cursor published an engineering blog post titled Auto-review. On the surface it describes "adding a classifier to the Agent," but the deeper story is this: when an agent can call local tools, read files, and touch production systems, a binary allow/deny switch is no longer sufficient.

Design philosophy: from a "switch" to a "knob"

Cursor's engineering team framed the core problem: a local agent touches files, credentials, environment variables, MCP tools, and production systems. Giving it high autonomy is risky; giving it low autonomy is extremely inefficient.

A more critical observation is approval fatigue: the traditional approach asks users to confirm every dangerous operation, and users quickly stop reading the pop-ups—effectively wearing down the safety net. Cursor's solution is a dedicated Classifier Agent that reviews tool calls in context before they actually execute:

Low-risk and aligned with user intent → allow
High-risk or diverging from intent → block, but instead of asking the user, return an explanation of "why it was blocked" to the parent agent
The parent agent automatically switches tools, narrows scope, or even bypasses the high-risk step entirely based on the feedback
Only when the parent agent cannot converge on a safe path on its own does it interrupt the user

This turns "autonomy" from a switch into a continuously adjustable knob.

Architecture details

The classifier runs inside the Agent's main loop (not as a separate endpoint), avoiding an extra network round trip per tool call
The classifier is itself a lightweight agent that can call ReadFile, Grep, Glob, and ListDir to understand context—for example, "python script.py" is harmless as a command, but the script's contents might modify a production database
Cursor explicitly rejects the "low-reasoning small model" route: small models with insufficient reasoning are actually slower and more expensive, because they repeatedly "think" and then deliver bad answers
The classifier currently intercepts about 4% of runs; roughly 7% of conversations trigger a user interruption. For comparison, some enterprise customers' previous full-blocking approaches ran as high as 40%

Training data and evaluation

The engineering team described the methodology for training the classifier:

6,122 labeled rows deduplicated from internal development sessions
Synthetic data fills in dangerous scenarios: reading secrets, touching production data, following untrusted instructions, high-side-effect operations
Evaluation runs the same full classifier pipeline as production, including tool use, final classification, model overrides, and parse failures
One key metric is decision stability—running the same case 6 times must yield consistent results; otherwise the policy or prompt isn't stable yet

A bigger signal than a bug fix

Read alongside Cursor's previous move (Bugbot 3x faster, 22% cheaper, 10% more bugs found), Cursor is pursuing an "Agent-era safety infrastructure" route: making agents more capable, faster, and cheaper while systematically managing "what if it goes wrong."

This matters as agents proliferate—many teams already use Claude Code, Codex, Cursor, Cline, Roo Code, and similar tools to modify production code directly, yet "what happens when the agent misbehaves" mostly relies on user vigilance. By productizing this mechanism and publishing implementation details, Cursor is effectively setting an industry standard.