Cursor earns AIUC-1 certification for agent security and reliability

Summary

Cursor announces that it has earned AIUC-1 certification after an independent review of its organizational controls and agent behavior. AIUC-1 combines an organizational-controls audit with adversarial product testing, translating the NIST AI Risk Management Framework, MITRE ATLAS, and OWASP’s agentic threat taxonomy into requirements for live AI systems. Schellman reviewed documented controls and AI governance practices, while evaluators tested IDE and cloud agents in a representative enterprise configuration across several thousand scenarios and two rounds. Testing covered rules, hooks, Auto-review, model-level safeguards, secrets protection, secure code generation, MCP security, identity and permissions, and potentially destructive actions. Cursor says its safeguards held in benign and adversarial conditions, with certification requiring quarterly testing and an annual full audit as AIUC-1 evolves.

Takeaways

1. 1

   AIUC-1 combines an audit of organizational controls with adversarial testing of the product itself, based on requirements derived from NIST AI RMF, MITRE ATLAS, and OWASP’s agentic threat taxonomy.

2. 2

   Schellman reviewed Cursor’s documented controls and AI governance practices, while evaluators tested the IDE and cloud agents across several thousand benign and adversarial scenarios.

3. 3

   Maintaining AIUC-1 certification requires testing at least quarterly and a full audit each year; the standard itself is updated quarterly, including coding-agent requirements.