---
title: "Securing our codebase with autonomous agents"
description: "After a fivefold increase in pull-request velocity over nine months, the team found static analysis and rigid code ownership insufficient for security at scale. It built a fleet of Cursor Automations powered by cloud agents, webhook and GitHub integrations, and a security MCP deployed as a just-in-time serverless Lambda function. The MCP provides persistent data, semantic deduplication using Gemini Flash 2.5, and consistently formatted reporting and follow-up actions, while Terraform standardizes review and deployment. Four templates cover PR review, segmented vulnerability hunting, dependency patching with reachability analysis and tests, and daily invariant-drift monitoring. Agentic Security Review has run on thousands of PRs in two months and prevented hundreds of issues from reaching production; the team says more automations are planned."
---

# Securing our codebase with autonomous agents

[Cursor](https://yomu.fyi/company/cursor) · Travis McPeak · Mar 16, 2026

**Type:** Announcement

## Summary

After a fivefold increase in pull-request velocity over nine months, the team found static analysis and rigid code ownership insufficient for security at scale. It built a fleet of Cursor Automations powered by cloud agents, webhook and GitHub integrations, and a security MCP deployed as a just-in-time serverless Lambda function. The MCP provides persistent data, semantic deduplication using Gemini Flash 2.5, and consistently formatted reporting and follow-up actions, while Terraform standardizes review and deployment. Four templates cover PR review, segmented vulnerability hunting, dependency patching with reachability analysis and tests, and daily invariant-drift monitoring. Agentic Security Review has run on thousands of PRs in two months and prevented hundreds of issues from reaching production; the team says more automations are planned.

## Context

Pull-request velocity increased fivefold over nine months, while static analysis and rigid code ownership were not sufficient to secure the codebase at that scale. Dependency patching was also time intensive, and general-purpose review tooling did not support the team's specific threat model or security-only CI blocking.

## Approach / What changed

The team uses Cursor Automations and cloud agents with webhook, GitHub, and codebase-change integrations. A security MCP running as a just-in-time serverless Lambda function provides persistent data, finding deduplication through Gemini Flash 2.5, and consistent reporting. Four workflows address pull-request review, vulnerability discovery, dependency patching, and invariant-drift monitoring, with Terraform managing security-tooling changes.

## Takeaways

- Agentic Security Review progressed from private Slack findings to PR comments and a blocking gate check after the team established confidence in its results.
- Anybump uses reachability analysis, code-path tracing, tests, and canary deployment to automate dependency patches and open PRs only after tests pass.
- Invariant Sentinel runs daily, compares results with prior runs using automation memory, revalidates detected drift, and reports evidence and code locations to the security team.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [Cursor](https://yomu.fyi/topic/cursor), [MCP](https://yomu.fyi/topic/mcp), [Security](https://yomu.fyi/topic/security), [Terraform](https://yomu.fyi/topic/terraform)

- Source: [Cursor](https://cursor.com/blog/security-agents)
- Source URL: https://cursor.com/blog/security-agents
- Ingested by Yomu: 2026-09-02T11:43:50.571Z

[Read original post](https://cursor.com/blog/security-agents)