Cursor and Endor Labs Put Security Gates Inside the Coding Agent Loop
Cursor and Endor Labs formalized a hooks-based security partnership for agentic coding, blocking package installs, MCP use, and risky commands inside the IDE loop.
- What happened: Endor Labs and Cursor formalized an agentic coding security partnership on May 28, 2026.
- The control point is not an LLM refusal policy. It is
Cursor hooksenforcing policy before tool calls, dependency installs, and commits.
- The control point is not an LLM refusal policy. It is
- Where it blocks: The integration targets malicious packages, unauthorized MCP servers, and risky commands inside the IDE agent loop.
- Watch: Hooks are necessary but not sufficient. CI permissions, secret scope, MCP allowlists, and agent configuration reviews still need to move together.
- CSA warned that prompt injection can become RCE when coding agents combine untrusted input, shell access, repository writes, and reachable credentials.
Endor Labs announced on May 28, 2026 that it had formalized an agentic coding security partnership with Cursor. The announcement opens with the familiar enterprise promise that engineering teams using Cursor ship more code, but the more important news is the control point. Endor Labs says Cursor hooks can apply policy before an agent executes a tool call, installs a dependency, or commits code.
The partnership stands out because it does not put all security judgment inside the model. Endor Labs describes the approach as deterministic policy enforcement. If an action violates organizational policy, the integration can block it regardless of whether the model produces a polished explanation. A malicious package, an unauthorized MCP server, or an unsafe command becomes an event that a policy engine can evaluate before it reaches the workstation or repository history.
Cursor had already previewed this architecture in its December 2025 hooks partners post. Cursor described hooks as functions that run around fixed points in the agent loop, giving organizations a way to observe, block, or modify agent behavior. The partner categories in that post covered MCP governance, code security, dependency security, agent safety, and secrets management. Endor Labs appeared in the dependency security category, intercepting package installation to catch typosquatting and dependency confusion before packages land on a developer machine.
Why security is moving into the agent loop
AI coding tools no longer stop at autocomplete. Cursor Agents, Claude Code, OpenAI Codex, Gemini CLI, and similar tools read repositories, run shell commands, install packages, execute tests, edit diffs, and finish work at PR or commit boundaries. In that workflow, a security scan at the end of a PR can arrive too late. A malicious package lifecycle script can run during install. A secret can leak before a commit. An MCP server can return sensitive data into the model context as part of a tool response.
Endor Labs addresses that timing problem directly. The company says Cursor hooks sit "before a tool call executes, a dependency is installed, or code is committed." Those three moments are where agentic coding turns permission into action. A tool call can touch an external system. A dependency install can bring supply chain risk onto the host. A commit moves generated code into the team's review and delivery pipeline.
Traditional application security tools were built around PR, CI, and release stages. That fit a workflow where humans wrote code first and security teams inspected the result later. It fits less cleanly when an agent installs a package, fixes test failures, rewrites several files, and produces a ready-to-review diff inside one session. The later the feedback arrives, the more work the agent and the developer have to unwind. Endor Labs argues that many issues are found and fixed inside the editor rather than after the coding session. The practical change is not just that a scanner appears in the IDE. It is that the IDE can become the place where an agent's next action is stopped or redirected.
What Cursor says hooks can cover
Cursor's December 2025 post framed hooks as a partner ecosystem rather than a single vendor integration. MintMCP was listed for MCP server inventory and tool usage monitoring. Oasis Security covered least-privilege policy and audit trails. Runlayer focused on centralized control through an MCP broker. In code security, Corridor and Semgrep were positioned around real-time feedback while the agent writes code. In agent safety, Snyk was described as detecting prompt injection and dangerous tool calls. For secrets management, 1Password was cited for checking environment file mount state before shell command execution.
That list shows Cursor treating hooks less like plugins that make the model smarter and more like interfaces that narrow what the agent is allowed to do under organizational policy. A developer can ask the agent to add a feature with a library, but the moment the agent runs npm install is still a separate policy event. A developer can add an MCP server, but the tools exposed by that server and the responses sent back into the model are separate audit concerns. Security enters the gap between what the human intended and what the agent actually does on the system.
Endor Labs' own details match that distinction. AURI is described as providing agent activity visibility, policy-as-code enforcement, secure code generation guidance, and blocking for vulnerable or malicious dependencies. Cursor Security's Travis McPeak said previous tools flagged vulnerabilities where more than 97% were not reachable from the application, while AURI helped focus on vulnerabilities that actually matter. That number is relevant for agent security because noisy controls can become counterproductive. If an agent and its human operator see too many low-value warnings, both can lose the priority signal.
LLM guardrails and deterministic hooks solve different problems
AI security discussions often collapse into prompt injection and refusal behavior. It is useful for a model to reject obviously malicious instructions, but coding agent risk grows in the execution environment. If an agent installs a dependency, the package manager may execute scripts. If an agent runs shell commands, host credentials may become reachable. If an agent uses an MCP server, internal API data and repository context may move through tool responses.
Endor Labs' line that "policy enforcement isn't a probability" points at this difference. LLM guardrails are probabilistic. A model can miss the risk, an attacker can route around the instruction hierarchy, or a long context can blur which instruction should win. A hook evaluates a structured event. A package install, a before-MCP-execution event, or a shell command can be checked against an allowlist, denylist, vulnerability database, reputation signal, or policy-as-code rule without asking the model to infer the risk from prose.
Hooks do not eliminate the whole problem. They only see the registered events and the information available at those points. Actions without policies can pass. Logical vulnerabilities in generated code still need SAST, review, tests, and production controls. Hooks also become part of the trusted configuration surface. If an attacker can alter the policy repository, MCP allowlist, or agent configuration files, the control layer can be weakened before the agent acts. The correct mental model is not "hooks are the end of AI security." It is that hooks provide execution points where agent behavior can be tied to organizational policy.
| Point | Agent action | Representative risk | Role of hook policy |
|---|---|---|---|
| Before tool call | Calling an MCP server, internal API, or shell tool | Unauthorized tool use or sensitive data exposure | Server allowlists, command denylists, and audit logs |
| Before dependency install | Installing npm, pnpm, pip, or cargo packages | Typosquatting, dependency confusion, malicious lifecycle scripts | Blocking via package reputation, CVE, and malicious package intelligence |
| Before commit | Moving an agent-generated diff into repository history | Hardcoded secrets, vulnerable patterns, policy-violating code | Secrets detection, SAST, and policy-as-code gates |
CSA's warning explains the timing
The Cloud Security Alliance's April 2026 research note described how AI coding tools expand the CI/CD attack surface when they receive privileged automation rights. The report says risk grows when an agent can read repository files, execute commands, make outbound network requests, and process content controlled by an attacker. Issue titles, PR bodies, comments, and documentation can become inputs that influence the agent while the agent still has shell access and repository write permissions.
CSA calls this pattern prompt injection to RCE. The injection is only the entry point. The target is the execution environment. A GitHub Actions runner or a developer workstation can contain repository write tokens, cloud credentials, container registry credentials, package signing keys, or deployment keys. When an AI coding agent operates in that environment, "the model was tricked" becomes "a command ran with runner privileges."
The same note also calls out slopsquatting. AI code generation tools can recommend package names that do not exist. If an attacker registers one of those hallucinated names in a package registry, an agent or developer can install a malicious package while trying to satisfy generated code. The research note cites work finding that, under certain conditions, roughly 20% of packages recommended by AI code generation tools were fictitious, and 58% of hallucinated package names were repeated across multiple runs. That repetition turns model error into a predictable target list.
Cursor hooks and Endor Labs' package firewall aim at exactly that point. The install event can be checked whether the package name came from a model, a human request, a generated test failure, or a copied code snippet. In cloud agent sessions where no one is visually inspecting every package name before install, pre-install checking becomes a more important control than an after-the-fact dependency dashboard.
Why AURI looks beyond Cursor
Endor Labs' AURI for Developers page shows a broader product direction than this Cursor announcement alone. AURI Developer Edition is described as providing SAST, SCA, secrets detection, and malicious open source package detection through an MCP server and CLI. The page lists Cursor, VS Code, Windsurf, Claude Code, and MCP-compatible clients, and it says asynchronous AI tools such as GitHub Copilot and OpenAI Codex can also connect in agent-driven workflows.
That scope matters because enterprise development groups rarely standardize on one AI coding surface. One team may use Cursor, another may use Copilot, a platform team may run Claude Code in terminals, and security engineers may wire internal tools through MCP servers. From the security team's side, the important assets are consistent policy, evidence, and audit trails rather than a separate configuration panel for each editor. Endor Labs' language around a "security harness for agentic coding" fits that enterprise problem.
The product page also says the MCP server connects AURI security intelligence to AI coding assistants while source code stays on the local machine. That claim matters in regulated industries. A security product that requires sending entire proprietary repositories to an external scanner can trigger privacy and compliance reviews before it helps with agent risk. Combining local scanning with read-only vulnerability intelligence can lower that adoption barrier. The tradeoff is that local execution makes host credentials and network policy more important, because the scanner is also running near the same workspace and tools as the agent.
The competition is becoming a control-plane fight
Cursor's hooks partner list makes the market direction easier to read. Semgrep addresses generated code vulnerability feedback. Snyk addresses dangerous tool calls and prompt injection. 1Password checks secret mount state before shell commands. Oasis Security and Runlayer connect MCP and enterprise access control. Endor Labs is strongest around dependency installation and supply chain risk. These products are converging on the same idea: do not only scan code after the agent writes it. Intercept the agent while it acts.
That changes how security tooling is sold and evaluated. Repository scanners, CI scanners, and SCA dashboards used to be the center of gravity. In agentic coding environments, the IDE, local agent runtime, cloud workspace, CI runner, MCP broker, and package registry all connect. A security product has to explain where it can block, where it records evidence, how developers request exceptions, and how approvals flow back into policy. Cursor hooks are one of those block points.
For Cursor, this is also an enterprise adoption requirement. In the Endor Labs announcement, Cursor's Brian McCarthy said engineering and security leaders are no longer asking whether to adopt agentic coding. They are asking how to scale it and trust it. Banks, insurers, healthcare companies, and other regulated organizations need audit-ready evidence and policy enforcement before productivity claims can clear procurement and security review. Faster code generation alone does not answer those questions.
What development teams should check now
First, inventory every place where an agent can install packages. Cursor desktop, cloud agents, Claude Code sessions, Codex tasks, Gemini CLI, and CI workflows may each invoke a package manager. A package install is not just a dependency update. It can execute lifecycle scripts, download native binaries, and make postinstall network requests.
Second, manage MCP server allowlists as policy. MCP is a convenient standard for giving agents access to internal systems, but tool responses also flow back into the model context. Without approved servers, allowed tools, redaction rules, and audit retention, installing an editor plugin can quietly change a data boundary.
Third, treat hooks and rules files as executable configuration. CSA recommends reviewing and verifying the integrity of .cursor/ configuration, MCP server definitions, and rules files used by AI coding assistants. If an attacker changes agent policy files, the agent's next action changes. These files are closer to deployment scripts than README copy or formatter settings.
Fourth, ask three questions before running agents in CI. Does the agent read untrusted user input? Can it access secrets, cloud credentials, or package signing keys? Can it execute shell commands or write to the repository? If all three answers are yes, the setup is high-risk regardless of the tool brand. Short-lived credentials, least repository permission, egress limits, artifact review, and separation of privileged workflows become baseline controls.
Open questions
The Cursor-Endor Labs announcement makes the direction clear, but public information leaves implementation details unresolved. It is not yet obvious how granular enterprise policy can be across organizations, repositories, workspaces, and user groups. The evidence format for blocked actions, hook coverage across cloud and desktop agents, and malicious package database synchronization for private registries also need more detail.
Developer experience is the other test. A coarse policy can stop the agent repeatedly and push developers into exception requests. A loose policy may produce audit logs without preventing incidents. Cursor and Endor Labs need to show not only that a risky action was blocked, but why it was blocked and what safe alternative the agent can use next. If a package install is denied, the useful response is an approved package, pinned version, internal registry mirror, or patch path inside the same workflow.
The larger signal is clear. AI coding security cannot be closed by model safety copy or a scanner at the end of a PR. Policy needs to sit where agent actions become system actions: tool calls, dependency installs, commits, MCP execution, and shell commands. Cursor hooks and Endor Labs' partnership show that this policy layer is moving into the IDE and agent runtime.