Loading the catalogue…
IDE extensions · Anysphere, Inc. · US
Cursor
US CLOUD Act exposureProprietary
STAV REVIEW · LAST REVIEWED 06/21/2026
“Dominant AI code editor, but all inference routes through Anysphere's US cloud — two unresolved CRITICAL sandbox escapes, a pending SpaceX acquisition, and zero Sovereign deployment options make this a hard caution.”
Good for
- Developer teams who prioritise AI-native editing UX and can accept a US-cloud-only inference path
- Enterprises that will admin-enforce Zero Data Retention and SAML SSO before rollout — the controls exist and are documented
- Organisations already invested in Anthropic or OpenAI model access who want the fastest-shipping AI editor in the market
- Teams comfortable monitoring a high-velocity advisory feed in exchange for near-daily feature and patch releases
Watch out for
- Two unresolved CRITICAL-severity sandbox escapes (CVE-2026-50549 and CVE-2026-50548, published 2026-06-05) allow agent write operations to escape the workspace; CVSS scores are unconfirmed — if NVD confirms ≥ 9.0, the risk rating escalates to critical
- All inference transits Anysphere's US cloud with no self-hosted, on-premises, or air-gapped option — full CLOUD Act exposure, unsuitable for Sovereign or data-residency-constrained workloads
- Prompts and code are collected server-side by default for free and Pro users; Privacy Mode and Zero Data Retention must be admin-enforced or individual users are exposed
- The pending SpaceX acquisition (definitive agreement signed 2026-06-16, close expected Q3 2026) may alter subprocessors, data contracts, and model-provider selection — reassess governance posture on deal close
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.
MODEL REQUIREMENTS
What Cursor needs from a model.
Required
- Streaming
- Tool calling
Recommended
- Code-native
- Extended thinking
- Long context (≥128k)
Data flow & telemetry
How Cursor moves data between the client, the inference endpoint and any vendor-owned services.
Data flow
- Direction
- direct_to_vendor
- Stores prompts
- Yes
Telemetry
- Collects telemetry
- true
- Privacy policy
- https://www.cursor.com/privacy
Vendor & licensing
- Developer
- Anysphere, Inc.
- Vendor country
- US
- Vendor type
- scaleup
- Funding status
- acquired
- Runtime type
- desktop_electron
- Open source
- No
- Licence
- Proprietary
- Licence risk
- commercial_only
- CLOUD Act exposure
- Yes
Security & maintenance health
Security profile
- Bug Bounty
- false
- Auto Update
- true
- Cve Count 90d
- 3
- Last Cve Date
- 2026-06-05
- Sbom Published
- false
- Cve Count Total
- 30
- Signed Binaries
- false
- Has Security Txt
- true
- Dependabot Alerts
- false
Maintenance health
- Archived
- false
- Commits 90d
- 2
- Last Commit
- 2026-05-12
- Contributors
- 25
- Contributors 90d
- 25
- Last Commit Date
- 2026-05-12
- Release Cadence Days