Cursor Auto-review: Using a Classifier Agent to Dynamically Manage Agent Autonomy

Cursor released Auto-review on June 11—a scheme that uses a "classifier agent" to dynamically assess risk before tool calls execute, upgrading agent autonomy from an "on/off switch" to a "finely adjustable dial." Measured user interruption rates dropped from ~40% under enterprise-style schemes to ~7%.

AI coding agents (Claude Code, Cursor, Codex, etc.) can already autonomously modify code, run commands, and touch production environments for hours. Greater capability means greater potential damage from autonomy: accidentally deleting databases, leaking production secrets, or being tricked by prompt injection into malicious actions. But blunt "confirm everything with the user" approaches cause "approval fatigue"—once dialogs flood in, users reflexively click "Allow," rendering the safety line useless.

Auto-review offers a third path: identify high-risk actions automatically without interrupting users, and return "actionable feedback" to the parent agent, which then adjusts its execution path on its own.

Core Mechanism

1. From "Switch" to "Dial"

Traditional schemes have users pre-set permission boundaries; crossing them triggers interception or dialogs. Auto-review turns this boundary into a continuous "risk curve"—at low risk the agent acts freely; crossing critical thresholds automatically slows things down.

2. Classifier Agent

• Uses a small model with sufficient reasoning ability to handle review duties
• Key finding: low-reasoning models are not necessarily faster. Without enough reasoning capability, models repeatedly search and burn more tokens—ending up slower and more expensive
• Runs on the same RPC stream as the parent agent, with no separate endpoint, avoiding added round-trip latency
• Has its own ReadFile / Grep / Glob / ListDir capabilities, letting it read workspace files before judging—making it possible to read a script's contents before deciding whether python script.py is dangerous

3. Feedback Loop (the Key Differentiator)

When the classifier flags high risk, instead of interrupting the user with a dialog: intercept → return an explanation to the parent agent → the parent agent can narrow the operation's scope, switch tools, or skip the step entirely → only interrupt the user when it cannot self-adjust.

This upgrades "safety decisions" from "blocking actions" to "providing actionable feedback."

Training Data: 6,122 Labeled Rows

The classifier's training data comes from two parts:

1. Real internal usage data

• About 12 hours of internal developer sessions collected
• Trimmed and deduplicated for common operations
• Finalized as 6,122 labeled rows
• Purpose: familiarize the classifier with normal dev patterns to avoid blocking routine operations

2. Synthetic data (for edge cases)

• The worst cases appear too rarely in normal usage and had to be synthesized
• Covered scenarios: agents reading secrets, touching production data, following untrusted instructions (prompt injection), executing high-side-effect operations

Notably, Cursor emphasizes that when policies change, evaluation sets must be relabeled or regenerated, otherwise the classifier is tested against an "outdated problem definition," causing evaluation data to drift from actual deployed behavior.

Performance Data

| Metric | Value | Comparison | |------|------|------| | Block rate when classifier engages | ~4% | Of actions the classifier reviews, only 4% are actually blocked | | Conversations triggering user interruption | ~7% | Share of all conversations requiring at least one user prompt | | Legacy enterprise-scheme block rate | ~40% | Block ratio from early enterprise partner deployments |

Compared to traditional enterprise interception, Auto-review reduces user interruptions roughly 4.5x, and the parent agent can autonomously resolve most situations after classifier engagement.

Covered vs. Not Covered

Automatically handled (never reach the classifier): allowlisted commands, sandbox-handled commands, most routine operations.

Require classifier review: commands depending on file/environment state (e.g., running scripts), operations involving sensitive resource access.

This keeps the classifier's load light—it is almost never a performance bottleneck.

Rollout Status and Scope

• New users: enabled by default
• Existing users: can enable in Settings > Agents
• Current stage: mainly focused on local agents in the desktop app
• Future plans: these ideas are expected to influence autonomy control across more scenarios

My Take

Auto-review's real contribution is not the classifier itself but the feedback loop's design philosophy—it turns "safety" from "interrupting humans" into "guiding agents." This approach can extend to any agentic system (not just coding):

• Browser automation agents
• Office automation agents
• Data analysis agents

As agent capabilities and action ranges keep growing, "how to let agents safely have autonomy" becomes the next core question. Cursor offers a referenceable engineering paradigm: use a smarter model to watch over another model.

Reference: https://cursor.com/blog/auto-review