Cursor Auto-review: Using a Classifier Agent to Dynamically Manage AI Agent Autonomy

Forum topic · QianXun · 2026-06-15

Summary

Cursor launched Auto-review on June 11, a system that uses a lightweight classifier agent to evaluate the risk of tool calls before execution, replacing binary allow/block permission boundaries with a continuously adjustable risk curve. The classifier runs on the same RPC stream as the parent agent, has read-only workspace tools (ReadFile, Grep, Glob, ListDir) to inspect context before judging, and—critically—returns actionable feedback to the parent agent instead of interrupting the user, letting it narrow scope or reroute autonomously. Training data combined ~12 hours of internal sessions distilled into 6,122 labeled examples plus synthetic data covering secrets access, production data, prompt injection, and high side-effect operations. Results: only ~4% of reviewed actions are blocked, and just ~7% of conversations trigger a user interruption, versus ~40% under earlier enterprise-level blocking—a roughly 4.5x reduction. Auto-review is enabled by default for new users and covers local agents in the desktop app. The design philosophy—security as guidance to the agent rather than interruption of the human—generalizes to browser, office, and data-analysis agent systems.

Cursor released Auto-review on June 11—a system that uses a "classifier agent" to dynamically evaluate the risk of tool calls before they execute, upgrading agent autonomy from an on/off switch to a finely adjustable knob. In practice, user interruption rates dropped from ~40% under enterprise-level schemes to ~7%.

Today's AI coding agents (Claude Code, Cursor, Codex, etc.) can autonomously modify code, run commands, and touch production environments for hours at a time. Greater capability means greater potential damage: accidental database deletions, leaked production secrets, or falling for prompt injection into malicious actions. But a blunt "confirm everything with the user" approach causes approval fatigue—once confirmation dialogs pile up, users reflexively click "Allow," rendering the safety layer meaningless.

Auto-review offers a third path: without interrupting the user, automatically identify high-risk actions and return "actionable feedback" to the parent agent, which adjusts its execution path on its own.

Core Mechanism

1. From a Switch to a Knob

Traditional approaches have users pre-set permission boundaries; crossing them triggers blocking or dialogs. Auto-review turns this boundary into a continuous "risk curve"—at low risk the agent acts freely, and crossing critical boundaries automatically slows things down.

2. The Classifier Agent

A small model with enough reasoning capacity handles the review duty
Key finding: low-reasoning models aren't necessarily faster. Insufficient reasoning causes repeated searching and more token consumption—slower and more expensive overall
It runs on the same RPC stream as the parent agent, with no separate endpoint, avoiding extra round-trip latency
It has ReadFile / Grep / Glob / ListDir capabilities, so it can read workspace files before judging—making it possible to read a script's contents before deciding whether python script.py is dangerous

3. The Feedback Loop (Key Differentiator)

This upgrades "security decisions" from "blocking actions" to "providing actionable feedback."

Training Data: 6,122 Labels

The classifier's training data has two sources:

1. Real internal usage data

~12 hours of internal developer sessions collected
Trimmed and deduplicated for common operations
Distilled into 6,122 labeled rows
Purpose: teach the classifier normal development patterns so it doesn't block routine work

2. Synthetic data (for edge cases)

The worst-case scenarios are too rare in normal usage and must be synthesized manually
Covers: agents reading secrets, touching production data, following untrusted instructions (prompt injection), and operations with large side effects

Notably, Cursor emphasizes that when policies change, evaluation sets must be re-labeled or regenerated—otherwise the classifier is tested against an outdated problem definition, and evaluation drifts from deployed behavior.

Performance Data

| Metric | Value | Notes | |------|------|------| | Block rate upon classifier review | ~4% | Of actions the classifier reviews, only 4% are actually blocked | | Share of conversations triggering user interruption | ~7% | Conversations with at least one user prompt | | Block rate under previous enterprise scheme | ~40% | From early enterprise pilot customers |

Compared with traditional enterprise blocking schemes, Auto-review reduces user interruptions by roughly 4.5x, and the parent agent autonomously resolves most cases after classifier review.

Covered vs. Not Covered

Handled automatically (bypass the classifier): allowlisted commands, sandbox-handled commands, most routine operations.

Requires classifier review: commands depending on file/environment state (e.g., running scripts) and operations involving sensitive resources.

This means the classifier's workload is light and rarely becomes a performance bottleneck.

Rollout and Scope

New users: enabled by default
Existing users: can enable via Settings > Agent
Current stage: focused on local agents in the desktop app
Future plans: these ideas are expected to influence autonomy control across more scenarios

My Take

Auto-review's real contribution isn't the classifier itself but the design philosophy of the feedback loop—it transforms "security" from "interrupting the human" into "guiding the agent." This approach extends to any agentic system, not just coding:

Browser automation agents
Office automation agents
Data analysis agents

As agent capabilities grow and their range of action widens, "how to let agents safely have autonomy" will become the next core problem. Cursor offers a referenceable engineering paradigm: use a smarter model to supervise another model.

Reference: https://cursor.com/blog/auto-review