Is Cursor safe for company code? Data handling, defaults and CVEs

the short answer

It can be, with the right settings. With Privacy Mode on, Cursor says customer data is not used for training and it holds zero data retention agreements with its model providers. The bigger risk is the local agent: since Cursor 3.6 the default Auto-review mode lets an LLM classifier approve commands, Cursor calls run modes best-effort guardrails, Workspace Trust is off by default, and it has fixed many agent advisories since 2025. Enforce Privacy Mode and Workspace Trust, restrict run modes, gate actions with hooks.

Training: Not with Privacy Mode on; may be used and stored with it off
Privacy Mode: Enforceable per team; on by default for Enterprise teams
Default run mode: Auto-review since Cursor 3.6: allowlist, sandbox and LLM classifier
Workspace Trust: Off by default; enforceable with the WorkspaceTrustEnabled MDM policy
Certifications: SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 42001:2023, AIUC-1

What Happens to Your Code

Admins can enforce Privacy Mode for every member of a team and use the AllowedTeamId MDM policy to block personal-account sign-in on company devices. Data residency is set per Enterprise team: US-only for certain models, with a 10% model-price uplift, and inference-only for EU/UK on request; SSO, BYOK and MCP servers are not covered. See personal AI accounts.

Question	Privacy Mode on	Privacy Mode off
Used for training?	No: “Customer Data will not be used for training by Cursor”	Cursor may use and store codebase data, prompts, editor actions and code snippets
Model provider retention	Zero data retention agreements with providers; flagged prompts may be stored for investigation; some models need admin approval because the provider retains data	Provider terms apply
Where requests go	Through Cursor’s backend to model providers, even with your own API key	Same
Code stored by Cursor	Durable storage only for Cloud Agents: the repository copy is deleted after the run, but environment snapshots are kept up to 30 days of inactivity and Cloud Agent conversation history indefinitely by default; file contents are cached temporarily, encrypted	Cursor may store and train on codebase data, prompts, editor actions and snippets

What the Local Agent Can Do by Default

Area	Default (as of October 2026)
Terminal commands	Since Cursor 3.6 the default run mode is Auto-review: allowlisted calls run, other shell commands run in a sandbox, and the rest go to an LLM classifier; only calls it blocks ask the user
Reads outside the workspace	Allowed without approval by default (Read Access: System, Cursor 3.23+); the Workspace setting makes them ask first
File edits in the workspace	No approval; saved to disk immediately
Configuration files	Edits need approval
MCP	Connections and tool calls need approval unless allowlisted
Network	Sandboxed shell commands get the “sandbox.json + Defaults” allowlist (package-manager domains); commands the classifier approves run outside the sandbox
Workspace Trust	Disabled, so a malicious repository’s `.vscode/tasks.json` autorun task can run on folder open (Oasis Security, 2025; no CVE)
Run modes	Auto-review (default), Allowlist, Run Everything; Cursor: “Auto-review is not a security boundary”

Agent-Related Advisories Cursor Has Fixed

The pattern across these: allowlists and sandboxes get bypassed, and agent-writable config files become code execution. Keep Cursor updated, and do not treat an allowlist as the only line. The full list is on Cursor’s GitHub advisories page.

ID	Published	Impact	Fixed in
CVE-2025-54135 “CurXecute”	Aug 2025	Prompt injection creates `.cursor/mcp.json` without confirmation → RCE	1.3.9
CVE-2025-54136 “MCPoison”	Aug 2025	An approved MCP config edited silently with no re-approval → persistent RCE	1.3
CVE-2025-54131	Aug 2025	Allowlist bypass → arbitrary command	1.3
CVE-2025-59944	Oct 2025	Case-sensitivity check lets the agent overwrite `.cursor/mcp.json` → RCE	1.7
CVE-2026-22708	Jan 2026	Terminal allowlist bypass via environment variables	2.3
CVE-2026-26268	Feb 2026	Sandbox escape via Git hooks	2.5
CVE-2026-50548	Jun 2026	Sandbox escape via agent-controlled working directory (critical)	3.0
CVE-2026-73218	Jul 2026	Sandbox escape via privileged containers (macOS with Docker Desktop and the Dev Containers CLI)	Affected below 3.0.0; the advisory lists no patched version

Admin Controls to Turn On

Workspace Trust is off by default; enforce it with the WorkspaceTrustEnabled MDM policy. For one policy that also covers Claude Code, Codex and Copilot CLI, see one policy across agents.

Control	Plan	What it does
Enforce Privacy Mode	Teams and Enterprise (on by default for Enterprise)	No training on team data; ZDR with providers
`WorkspaceTrustEnabled` via MDM	Any managed device	Turns Workspace Trust on so untrusted folders do not auto-run tasks
`AllowedTeamId` via MDM	Enterprise	Blocks personal accounts on company devices
Restrict run modes and sandbox network	Team settings	Team settings override local `permissions.json`
MCP allowlist	Enterprise	Allow servers by command or URL
Enterprise `hooks.json` with `failClosed: true`	System paths on each machine	Gate shell and MCP calls; fail closed on hook errors
Audit logs, SIEM streaming, OTel	Enterprise	Admin-event record and usage telemetry

FAQ

Does bringing my own API key keep code away from Cursor?

No. Cursor’s data-use page says requests still go through Cursor’s backend when you use your own key.

Is Cursor SOC 2 certified?

Cursor lists SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 42001:2023 and AIUC-1, with reports in its trust center. That covers Cursor’s service, not your controls over the agent.

Is the command allowlist enough to stop dangerous commands?

No. Cursor calls run modes best-effort guardrails, and several advisories were allowlist bypasses. Deny dangerous actions in a hook that fails closed.

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.