Governing agent autonomy with Auto-review
Cursor's Auto-review puts a classifier agent between your agent and risky actions: it blocks about 4% of actions, versus ~40% under old enterprise defaults, letting agents run longer without going fully unsupervised.
**The gist** Cursor shipped **Auto-review** (June 11, 2026): a classifier agent that inspects each agent action in context — using ReadFile, Grep, and similar tools — before it executes. It blocks about **4%** of actions versus a **~40%** enterprise-baseline block rate, and only **~7%** of chats see a user interruption. It runs in the same RPC stream as the parent agent to keep latency low.
**Why it matters** This treats autonomy as a **dial, not a switch**: instead of approving every command or allowing everything, a second model judges whether the next action crosses a real boundary. On by **default for new users**; existing users enable it in **Settings > Agents**. Worth trying if permission prompts are your bottleneck.
**The gist** Cursor shipped **Auto-review** (June 11, 2026): a classifier agent that inspects each agent action in context — using ReadFile, Grep, and similar tools — before it executes. It blocks about **4%** of actions versus a **~40%** enterprise-baseline block rate, and only **~7%** of chats see a user interruption. It runs in the same RPC stream as the parent agent to keep latency low. **Why it matters** This treats autonomy as a **dial, not a switch**: instead of approving every command or allowing everything, a second model judges whether the next action crosses a real boundary. On by **default for new users**; existing users enable it in **Settings > Agents**. Worth trying if permission prompts are your bottleneck. **Watch out** It's **early** and covers only **local agents in the desktop app**. A 4% block rate means trusting the classifier on the other 96% — it was evaluated on **6,122 labeled rows** from Cursor's internal sessions and synthetic cases, not your codebase.