Cursor (Anysphere)

Does Cursor send your code to model providers? Privacy Mode is what limits it. Cursor turns it on by default for Teams and Enterprise; on an individual plan, check that it is switched on.

Plain-English risk rating: 3 of 5 (Hobby/Pro without Privacy Mode) / 2 of 5 (Pro with Privacy Mode) / 1 of 5 (Teams/Enterprise)

Cursor is a widely used AI code editor, and its risk profile differs from GitHub Copilot's. Two distinguishing facts: (1) Cursor's Privacy Mode genuinely enforces Zero Data Retention with model providers (Cursor says its model providers will not store or train on your data, and Cursor does not train on it), but Privacy Mode is opt-in on Hobby and Pro tiers — Teams and Enterprise have Privacy Mode on by default, and admins can enforce it organisation-wide so members cannot switch it off. (2) Cursor has had a documented string of high-severity vulnerabilities throughout 2025 and 2026 — CurXecute, MCPoison, NomShub, and CVE-2026-26268 — each of which allowed remote code execution on a developer's machine simply by opening a malicious repository.

For any developer working on client code or proprietary IP, the right configuration is either a paid individual plan with Privacy Mode explicitly enabled, or Teams (from US$30 a user a month) with admin enforcement switched on.

Recommended for

• Sole proprietor developer: A paid individual plan (Plus, from US$8 a month) with Privacy Mode toggled on immediately after install. Treat the toggle as part of setup, not optional.
• Small team (2-10 developers): Teams, from US$30 a user a month. Privacy Mode on by default, admin enforcement available, and SOC 2 documentation are worth the price gap over Pro for any business handling client code.
• Regulated industry: Teams or Enterprise with admin enforcement of Privacy Mode switched on, SSO via SAML, audit log streaming to a SIEM, and a documented policy restricting Cursor to non-regulated repositories. Scope sensitive workloads to a separate workflow.
• The honest answer for most 1-10 employee businesses with developers: Cursor is genuinely the most capable AI coding tool as of mid-2026. The risk is real but manageable. Pay for Teams, turn on admin enforcement of Privacy Mode, keep the tool updated, and treat repository cloning as a privileged action.

Data retention default

• Hobby and Pro (Privacy Mode OFF): Code may be retained by Cursor and processed by model providers (OpenAI, Anthropic) under their standard API terms
• Hobby and Pro (Privacy Mode ON): Zero data retention with model providers. Cursor says cached file contents are temporary and never permanently stored, and code is not used for training by Cursor or its model providers. Prompts that trigger abuse detectors may be stored for investigation
• Teams and Enterprise: Privacy Mode is ON BY DEFAULT, and an admin can enforce it organisation-wide so members cannot disable it. Until an admin turns enforcement on, a member can switch the default off. Audit logs available.
• Indexing data: File paths are encrypted using client-generated keys; plaintext code is discarded after embeddings are computed. This applies regardless of Privacy Mode setting.

Training opt-out

Hobby and Pro — Privacy Mode is OFF by default. This is the most important setting Cursor users need to change. To enable: Settings → Cursor → Privacy Mode → ON.

Teams and Enterprise — Privacy Mode is ON BY DEFAULT, and an admin can enforce it so members cannot switch it off. Those are two separate things and the difference matters for a buyer: the default protects you from day one, but until an admin turns enforcement on in the Cursor dashboard, an individual member can still switch Privacy Mode off.

Corrected 25 September 2026, and wrong in two ways. This section previously read: Business and Enterprise — Privacy Mode is forcibly enabled by default. Organisation admins enforce it; individual users cannot disable it. First, Cursor has no plan called Business. Its plans are Hobby, Individual, Teams and Enterprise, and the tier at $40 per user per month that we were describing is Teams. Second, we collapsed a DEFAULT into an ENFORCEMENT. Cursor states that Privacy Mode “is enabled by default for all team members” and, separately, that admins “can enforce it organization-wide” so members cannot disable it. Enforcement is an action an admin takes, not something the plan does for you, and our wording told readers they were protected from something they still had to switch on. Read at source on 25 September 2026 at the Cursor privacy help page. See Corrections.

Note: Privacy Mode controls whether your code is used for training and stored by Cursor. It does not control the underlying model provider's standard logging — for that, the contractual ZDR arrangements Cursor has with OpenAI and Anthropic apply.

Zero Data Retention (ZDR) availability

• Cursor enforces ZDR with its model providers when Privacy Mode is enabled — it says it has zero-data-retention agreements with all of them and names SpaceXAI, OpenAI, Anthropic and Meta. One exception: prompts that trigger abuse detectors may be stored for investigation. Models without ZDR are labelled or need an admin to switch them on. (Updated 3 October 2026 against cursor.com/data-use, 3 September 2026.)
• This is the strongest ZDR posture of any AI coding tool in this database — it propagates the ZDR commitment down the provider chain
• Customer Managed Encryption Keys (CMEK) available for organisations with extreme security requirements (Teams/Enterprise tiers)

Plan tiers and pricing (read 24 October 2026)

Tier	Price (USD)	Privacy Mode default	Suitable for
Free	$0	Off unless you switch it on	Personal experimentation only
Plus	$8/month	Off unless you switch it on	Light individual use; enable Privacy Mode for any client work
Premium	$30/month	Off unless you switch it on	Regular individual use; same caveats
Super	$100/month	Off unless you switch it on	Heavy individual use; same caveats
Ultra	$200/month	Off unless you switch it on	Power users with high-volume agent usage
Teams	From $30/user/month	On by default; admin can enforce; new members inherit the team setting	Small teams handling client or proprietary code
Enterprise	Custom	On by default; admin can enforce	Larger orgs needing SAML, SCIM, CMEK

Updated 25 October 2026 from cursor.com/pricing (prices in US dollars, excluding tax). Cursor has renamed its individual plans: there is no longer a Hobby or Pro plan. Our rating labels above still use the old names until our post-launch re-score: read Hobby as Free, and Pro as any paid individual plan. Cursor's current data-use page (3 September 2026) says what Privacy Mode does but not its default on each plan, so the defaults in this table are from Cursor's earlier documentation; check Settings, Privacy Mode, when you install. Teams was listed at US$40 a user a month when we last checked; it is now from US$30.

Jurisdiction

• Primary processor: Anysphere Inc. (the company behind Cursor), San Francisco, California, USA
• Cloud infrastructure: AWS (US, EU, Singapore), Azure, Google Cloud, Vercel and Cloudflare, per Cursor's subprocessor list (captured 29 August 2026)
• Model providers (OpenAI, Anthropic) process inference in the United States by default
• SOC 2 Type II attestation; supports SAML SSO and SCIM provisioning for enterprise deployments
• Certifications added since our last review. As at 25 August 2026 Cursor also publishes ISO/IEC 27001:2022, ISO/IEC 42001:2023 and AIUC-1. ISO 42001 is the AI management-system standard and is the more meaningful of the three here, because it is specifically about how AI systems are governed rather than general information security. Verified against Cursor's published security page on 29 August 2026. We have not moved the risk rating on the strength of these: the Hobby and Pro bands rest on Privacy Mode shipping switched OFF by default, which a certification does not change. Certifications are evidence of governance, not of a safer default.

Breach history (public incidents)

August 2025 — CurXecute (CVE-2025-54135, CVSS 8.6) and MCPoison (CVE-2025-54136)

Two separate critical vulnerabilities disclosed within days of each other. CurXecute (disclosed August 1, 2025 by Aim Security) allowed remote code execution: when Cursor was configured with an external MCP server, an attacker could return a prompt from the external service that rewrote the victim's Cursor configuration file (.cursor/mcp.json) to inject arbitrary commands. With Auto-Run enabled, Cursor would immediately execute the malicious commands. MCPoison (disclosed August 5, 2025 by Check Point Research) exploited a related issue in MCP integration. Both were responsibly disclosed (July 7 and July 16 respectively) and patched promptly.

Sources: Tenable advisory; Aim Security disclosure; Check Point Research; NSFOCUS CERT

October 2025 — Case-sensitivity sensitive-file-overwrite bypass (CVE-2025-59944)

Lakera researcher Brett Gustafson discovered that Cursor's file-path validation was case-sensitive on case-insensitive filesystems (Windows, macOS), allowing crafted inputs to overwrite or add files controlling project execution — including .cursor/mcp.json. Patched in Cursor 1.7.

Source: Lakera disclosure, October 2025

November 2025: MCP installation flow RCE (CVE-2025-64106, CVSS 8.8, published 4 November 2025)

Cyata Security Ltd. discovered a vulnerability in Cursor's Model Context Protocol installation flows that allowed attackers to execute arbitrary commands on a developer's machine via crafted deep links during MCP server installation. Patched within two days of discovery.

Source: Silicon Angle; SC Media, December 2025

February 2026 — NomShub vulnerability chain (Straiker disclosure)

Straiker researchers disclosed a vulnerability chain in Cursor combining indirect prompt injection in coding agents with a command sandbox bypass and abuse of Cursor's remote tunnel feature. Mounting an attack required no user interaction beyond opening a malicious repository. Because the exploited tunnel binary is legitimate (signed and notarized), attackers could gain full file system access and command execution on macOS systems, where Cursor runs without sandbox restrictions.

Source: SecurityWeek, April 2026

February-April 2026 — Git hooks RCE (CVE-2026-26268, CVSS 8.1)

Novee Research disclosed that opening a malicious Git repository in Cursor could trigger arbitrary code execution through abuse of standard Git features. The vulnerability does not stem from a bug in Cursor's core code — it arises from how the AI agent interacts with existing Git features when operating on untrusted repositories. Cursor fixed it in version 2.5, and the CVE record was published on 13 February 2026 (rated 8.1, high); Novee Research's write-up and press coverage followed in April 2026. Corrected 25 October 2026: we had dated public disclosure to 28 April 2026, and described these flaws as critical; most are rated high. See Corrections.

Sources: Hackread; Cybersecurity News; GBHackers (all April 2026)

Pattern observation: Cursor has had at least five separate high-severity vulnerabilities disclosed between August 2025 and April 2026, each allowing remote code execution from opening an untrusted repository or installing a malicious MCP. The vulnerability surface is structurally larger than Copilot's because Cursor is a full IDE with agent autonomy and MCP integration. Patches have been prompt, but the cadence of disclosure is notable and should be factored into deployment decisions.

What this means in plain English for SMB owners

Three honest takeaways:

1. Privacy Mode is not on by default on the tier you're probably using. Cursor's individual plans (Free, Plus, Premium, Super and Ultra) ship with Privacy Mode off, according to Cursor's earlier documentation. If you're using an individual plan for client work and you haven't toggled this on, your code has been processed by model providers under standard API terms (which means logging, not training, but the data has left your machine and entered third-party retention).

1. Cursor's vulnerability cadence is the highest of any AI tool in this database. Five high-severity code-execution flaws in nine months. The mitigations are: stay updated immediately when new versions ship, treat repository cloning as a privileged operation, and consider whether you actually need Auto-Run enabled. For Teams and Enterprise, restrict MCP server installation to admin approval only.

1. The Teams tier (from US$30 a user a month) is the inflection point. Below that you're trusting individual developers to remember to toggle Privacy Mode and stay updated. Above that, Privacy Mode is on by default and an admin can enforce it for the whole organisation and you get SOC 2 documentation, SSO, and audit log streaming. For any team writing software professionally, the upgrade is the simpler defensible choice.

Verified: the ZDR claim holds — with two qualifiers

This page makes the strongest claim in our database — that Cursor pushes zero data retention down the provider chain — so we re-verified it against Cursor’s own data-use page rather than leaving it on trust. It holds. Cursor states that with Privacy Mode enabled it maintains zero data retention agreements with all providers, and that model providers will not store or train on your data. Privacy Mode is available on every plan including free, can be set by a team or enterprise admin, and new team members inherit the team’s setting — which is the right default for a growing business.

Two qualifiers our earlier write-up did not carry, and both matter:

• Not every model is a zero-retention model. Cursor says non-ZDR models are either designated as such or require an admin to opt in before they can be used in a workspace. So the guarantee attaches to Privacy Mode plus model choice, not to Privacy Mode alone. If you run a team, the admin opt-in is the control worth knowing about — it is the one setting that can quietly take a workspace outside the ZDR envelope.
• Risk classifiers are an exception. Cursor notes that, subject to their own policies, model providers — and Cursor itself — may run risk classifiers over requests. Zero retention for training is not the same as nothing ever being processed or briefly held for safety purposes.

Provider list updated: Cursor now points users to the retention documentation of SpaceXAI (the renamed xAI), OpenAI and Anthropic. Note the addition of SpaceXAI — if your AI policy names approved providers, an xAI model reaching your codebase through Cursor may not be covered by it. Cursor also states it uses no infrastructure in China and no China-headquartered subprocessors, and that it respects model blocklists.

The full subprocessor list, captured 29 August 2026. Cursor names sixteen subprocessors. The ones that see your prompts or code are the inference providers: OpenAI, Anthropic, Google Gemini, SpaceXAI, Fireworks, Baseten, Together and Databricks. Cursor states it holds a zero data retention agreement with Together, which hosts its custom models. Infrastructure sits with AWS (US, EU, Singapore), Azure, Google Cloud, Vercel and Cloudflare; Datadog handles logging and WorkOS handles enterprise sign-on. If your AI policy names approved providers, that list is longer than most policies anticipate — and it is the inference providers, not the hosting ones, that matter for what leaves your codebase.

One monitoring caveat we will state plainly, updated 29 August 2026: Cursor’s subprocessor list lives on a trust portal that renders in JavaScript, so an automated fetch returns an empty shell and we cannot watch it the way we watch the other pages. We now hold a dated snapshot taken by hand in a browser, and we compare each new hand capture against it, so a change will be caught — but only when someone takes the next capture, not the same day it happens. We watch the data-use and security pages automatically.

Frequently asked questions

Sources

• Cursor Trust Center subprocessor list: https://trust.cursor.com/subprocessors — captured by hand in a browser on 29 August 2026. This page renders in JavaScript and returns an empty shell to an automated fetch, so it is snapshotted manually rather than monitored daily.
• Cursor security documentation: https://docs.cursor.com/en/account/privacy (verified 2026-05-24)
• Endor Labs: Cursor Security guide (March 2026)
• TechJack Solutions: What Is Cursor IDE? (March 2026)
• Tenable: FAQ on CurXecute and MCPoison (August 2025)
• Lakera: Cursor vulnerability CVE-2025-59944 analysis (October 2025)
• SC Media: Cursor IDE vulnerability MCP installation (December 2025)
• Hackread: Cursor AI IDE vulnerability hidden Git hooks (April 2026)
• Cybersecurity News: Cursor AI Coding Agent Vulnerability (April 2026)
• GBHackers: Cursor AI Coding Agent Vulnerability disclosure (April 2026)
• SecurityWeek: NomShub vulnerability chain (April 2026)
• NSFOCUS CERT: CVE-2025-54135 advisory (August 2025)

Related on AI Leakage

• Compare all 29 AI tools in the risk directory — see how Cursor (Anysphere) stacks up against the rest, tier by tier.
• Take the 5-minute “Am I Leaking?” check — a personalised view of your business’s AI exposure.
• Check a prompt before you paste it — our free Data-Safe Prompt Rewriter.
• Shadow AI vs AI leakage — why even approved tools like Cursor (Anysphere) can leak data.
• Get plain-English AI Leakage Alerts — we email you when an AI tool you use changes its data policy or has an incident.
• Get the free AI Acceptable Use Policy template — a plain-English policy with the tool-by-tool risk guide built in.

Compare similar tools: Cursor (Anysphere) is one of 3 tools in AI coding tools compared, which sets out each one’s rating and what it does with your data, side by side.