Cursor: how to develop software with AI assistance

Cursor is a code editor with artificial intelligence assistance. The official documentation introduces it through the agent: you open a folder, ask for an explanation or a change, and the tool searches the repository, reads files, edits the code and shows the result for review.

This article describes how it works based solely on Cursor’s documentation, consulted on October 8, 2026, and on independent studies. The newsroom did not test the product for this article. Features, mode names and prices change frequently; when a piece of information depends on the date, we say so.

If the concept of an agent is still new to you, start with what AI agents are.

Cursor’s three layers

In practice, Cursor offers three levels of help, from the simplest to the most autonomous.

The first is Tab, AI autocomplete. According to the Tab help page, it suggests code as you type, based on recent edits, the surrounding code and errors flagged by the linter (the automated style and error checker). The suggestion appears in gray; the Tab key accepts it, Esc rejects it. Tab can change several lines, add missing imports and predict the next edit location, even in another file.

The second is the agent, opened in a side panel. The agent page says it is made of three components: instructions (the system prompt and rules), tools and the model you choose. Cursor tunes instructions and tools for each supported model.

The third is cloud agents, which work on remote virtual machines while you do something else. We cover them further on.

What the agent can do

The documentation lists the agent’s tools:

• search for files and folders by name, structure or text pattern;
• search the web;
• read files, including images, when the chosen model understands images;
• edit files and apply changes automatically;
• run terminal commands and follow the output;
• control a browser to take screenshots and test the application;
• generate images and ask clarifying questions without stopping work.

According to the same page, there is no limit on the number of tool calls the agent makes in a task. This gives autonomy, but also consumes plan usage, as we will see.

To find code, Cursor uses its own exact-search mechanism called Instant Grep. The search page states that this index is built and queried on your machine, without sending paths or code to build the index. The caveat follows: when the agent opens a file it found, its content may go in the request to the model. For broad searches, the agent can create an exploration subagent, which works in a separate context window and returns only a summary. The context window is everything the model has in front of it at a given moment; see context and memory in AI.

The modes: ask, plan, execute

The same agent panel has different modes, switched with Shift+Tab.

• Ask: according to the Ask mode help, it is a read-only mode. The agent answers questions and explores the code without editing anything. It is useful for understanding an authentication flow or finding out where a connection is configured.
• Plan: the Plan Mode page describes a cycle in which the agent asks clarifying questions, researches the code, writes an implementation plan and waits for you to review and edit it before building.
• Agent (execute): the default mode, in which the agent edits and runs commands.

The documentation gives useful guidance on Plan Mode. If the agent builds something different from what you wanted, the recommendation is not to try to fix it with successive requests: undo the changes, refine the plan and run it again. According to the text, this is usually faster and gives a cleaner result.

A typical workflow, according to Cursor itself

The quickstart guide proposes a sequence that serves as a model:

1. Ask the agent to explain the codebase and point out the main files.
2. Ask for a few small, safe improvements, with pros and cons, and pick one.
3. Review the diff (the comparison between the old and new versions) and ask the agent to run the checks the project already uses: tests, type checking, lint or the local build.
4. For larger changes, which touch several files or require research, use Plan Mode.

While the agent works, you can queue messages or send a correction that is delivered at the next tool call, without interrupting the action in progress. The agent also creates checkpoints, copies of the state of the files before significant changes. You can restore a checkpoint, but the documentation warns that they stay only on your machine and are meant for undoing the agent’s changes; for version control, use git.

Rules: how to provide permanent context

Language models do not keep memory from one response to the next. The rules page starts from this point: rules are persistent instructions that Cursor places at the start of the model’s context.

There are four types: project rules, stored in .cursor/rules as .mdc files and versioned with the code; user rules, which apply to all your projects; team rules, managed in a dashboard on the Teams and Enterprise plans; and the AGENTS.md file, a simple Markdown alternative. A project rule can always apply, kick in when a file from a certain path is in use, be chosen by the agent based on a description or only apply when you mention it with @.

The documentation’s best practices are straightforward: short rules (under 500 lines), concrete and focused on what recurs. It advises against copying entire style guides, because a linter does that job better, and suggests starting simple and only creating a rule when the agent repeats the same mistake. The logic is the same as in prompt engineering techniques: a clear, specific instruction works better than a long one.

Security and permissions

The agent security page begins by acknowledging that AI can behave unexpectedly because of prompt injection (malicious text hidden in a file or page to manipulate the agent), hallucinations and other problems. The defaults described, as of the date consulted, are these:

• Reading files and searching code does not require approval.
• The agent can modify project files without approval, except configuration files. Changes go straight to disk, which is why the documentation insists on using version control.
• Terminal commands require approval by default.
• Connections to external tools via MCP (Model Context Protocol, a standard for connecting agents to services and data) require approval, and so does each call.
• Workspace trust is turned off. For repositories you do not know, the documentation recommends opening them in an ordinary text editor.

You adjust this autonomy with Run Modes. Auto-review mode runs calls from an allowlist, executes other commands inside a sandbox (an isolated environment with restricted file and network access) when possible and sends the rest to a classifier, a smaller model that decides whether the action can proceed. There is also Allowlist mode, with only the allowlist, and Run Everything, which executes everything without asking. The documentation is explicit: Auto-review “is not a security boundary”, and the classifier can err in both directions.

To hide sensitive files, there is .cursorignore. The ignore file page says it blocks access by the agent, Tab and inline editing, but does not prevent terminal commands or MCP tools from reading those files. It adds that complete protection “is not guaranteed” because of the unpredictability of models.

On privacy, the data page states that Cursor sends prompts and code snippets to model providers such as OpenAI, Anthropic and Google. With Privacy Mode on, code is not used to train models; for teams, it is on by default. If you use your own API key, the provider’s rules apply.

Cloud agents and code review

Cloud Agents run on isolated virtual machines, with the repository cloned, dependencies installed and network access. They work on a separate branch and submit changes for review, and can be triggered from the app, the web, Slack, GitHub comments or an API. The documentation makes an observation that applies to any agent: an agent that writes code but cannot run tests “cannot close the loop” on its own work, which is why setting up the environment is the most important step.

Bugbot is the automated reviewer for pull requests (requests to merge code). It reads the changes, leaves comments with explanations and suggestions and posts a status on the repository. A configuration detail: by default, findings appear as a neutral status, which does not block merging the code; you need to enable the option to fail on unresolved issues, when available.

How much it costs

As of October 8, 2026, the plans page listed: Hobby, free with limited usage; Pro, US$ 20 a month; Pro+, US$ 60; Ultra, US$ 200; Teams Standard, US$ 40 per user per month; and Teams Premium, US$ 120 per user per month. Enterprise plans are priced on request.

The plan price does not mean unlimited use. According to the models and pricing page, paid individual plans have two monthly usage “pools”: one for Cursor’s own models and another for third-party models, charged at the model’s API price, with the option to pay for overages. Consumption is measured in tokens, the units of text the model processes; see tokens in AI models. Larger models, long contexts and tasks with many tool calls cost more.

What independent studies say

The productivity promises of tools like Cursor are big. Independent measurements are more cautious.

In 2025, the research organization METR ran a controlled experiment with 16 experienced developers from large open-source projects, on 246 real tasks. The most used tools were Cursor Pro with Claude 3.5 and 3.7 Sonnet models. With AI allowed, the developers took 19% longer. They expected to gain 24% and, afterward, still believed they had gained 20%. The authors treat the result as a snapshot of early 2025 in a specific context. In a February 2026 update, METR said it believed the gains had increased, but classified its new data as “very weak” evidence and announced changes to the study design.

Another study, by Carnegie Mellon researchers, compared 806 GitHub repositories that adopted Cursor with similar projects that did not. The authors found a 3- to 5-fold increase in lines added in the first month, an effect that dissipated after two months. At the same time, static analysis warnings rose 30% and code complexity 41%, persistently. The study’s conclusion is that quality assurance became the main bottleneck. For a broader overview of these measurements, see how much work AI automates in programming and how to measure productivity in AI projects.

Cursor, Copilot and Claude Code

Cursor is a complete editor with the agent inside. GitHub Copilot works mainly as an extension to existing editors and as an agent integrated into GitHub; see GitHub Copilot workflow and limitations. Anthropic’s Claude Code runs in the terminal, in IDEs and on the web, always with the agent at the center of the work; see how Claude Code works. In the newsroom’s assessment, the three converge on the same cycle of researching, editing and verifying; what changes is where the work happens and which controls are on by default.

Key takeaways

• Cursor brings together autocomplete, an agent with ask, plan and execute modes, project rules and cloud agents.
• The agent edits files without asking by default. Always work with git and review the diff.
• The classifier, sandbox and .cursorignore reduce risks, but the documentation admits they are not guaranteed barriers.
• Ask the agent to run tests and checks; without that, the checking is up to you.
• Independent studies point to uncertain or short-lived speed gains and more code complexity. Plans and prices change: check the documentation before deciding.