How HiddenLayer Secures Cursor AI Agents

A Cursor agent acts with your developer's credentials: it reads files, runs shell commands, and calls Model Context Protocol (MCP) servers. HiddenLayer lets your security team see each of those actions and stop it before it runs, by checking it against your policy and then blocking it, redacting it, or recording it. It works through Cursor's hooks, its built-in extension points.

This is the first individual integration spotlight in our series on AI security that meets you where you are. Earlier posts covered how HiddenLayer delivers research-backed AI security solutions across the cloud and in the SOC.

The agent is the attack surface

The model suggests actions. The harnesses around it, the prompts, tools, and MCP servers, carry them out. That is where attacks land.

Our research on coding agents shows the pattern. Instructions hidden in a README can tell an agent to find API keys in the workspace and send them out with curl. Two tools that are each safe alone, one that reads files and one that draws diagrams, can together send an SSH key to an outside server. Any agent that reads untrusted files and can act on them should be assumed exposed to attacks of this shape. Our researchers have disclosed more than 65 CVEs in AI systems.

Why existing controls miss it

Denylists judge text, and attackers choose the text. Per-tool approvals judge one call at a time, and the SSH key example contains no bad call, only a bad sequence. Most endpoint tools see the same user running the same curl either way. Most code scanners run on commits and pull requests, and the agent acts before either. Asking another model whether a command looks safe does not help, because that model reads the same attacker-controlled text. Agent behavior also varies from run to run, so you cannot test every path in advance. The control has to sit outside the model and judge what the agent attempts.

What HiddenLayer does in Cursor

Cursor's hooks call an on-device HiddenLayer plug-in wherever the agent acts. The plug-in securely sends the content to HiddenLayer, which evaluates it against your policy and returns a decision that Cursor enforces. (Ask us about self-hosted and air-gapped options as well.)

Every decision is recorded in the HiddenLayer Console. HiddenLayer gates:

• Prompts, before they are submitted.
• Tool calls and shell commands, before they run.
• MCP calls and their results, before the model sees the output.
• File reads, including Tab completions, before the file is opened.

• Redact, or block. Where Cursor allows it, redaction removes the secret and the agent keeps working. Where it does not, HiddenLayer blocks, and the Console shows which action was enforced.
• Whole session. HiddenLayer evaluates the session, not single calls, which is how it catches sequences like the SSH key example.
• One policy. The same project policy that covers your other AI traffic covers Cursor.

Current HiddenLayer customers can start here:

1. Create an API key and a project in the HiddenLayer Console. The project selects your policy.
2. Get the plug-in from your HiddenLayer representative and deploy it to developer machines with your mobile device management tool, such as Jamf or Microsoft Intune. Run hl runtime setup. The same plug-in covers Claude Code and GitHub Copilot CLI.
3. Watch first. Put rules in detect mode and review findings in the Console.
4. Enforce next. Customize rules to block for prompts, tool calls, and shell commands.

Five prompt injection detections run from day one. Three of them, Coerced Execution, Coerced Data Exfiltration, and Coerced Secret Read, describe the behaviors in the attacks above.

Book a demo to see Agent Harness Security running with Cursor.

‍