Cursor's Head of Security: Never trust the agent writing your code

"The hardest thing in security is always the chaos," according to Travis McPeak, Head of Security at Cursor. He shared this with Nancy Wang, CTO of 1Password, and Dev Tagare, Senior Director of Engineering at Google, on a recent episode of Zero-Shot Learning, the podcast about how AI gets built, secured, and deployed. "We're always going to have more that we have to be doing than we can actually do." Travis has worked within that constraint in security roles at Netflix and Databricks and now at Cursor, the AI-native IDE, where agents write production code for a rapidly growing base of developers worldwide. Agents in the development pipeline introduce a new kind of actor. They are non-deterministic, have access to tools, are exposed to untrusted input, and often operate near credentials, source code, and production systems. All with no guarantee that past behavior predicts future actions. Unlike developers who earn trust through accountability and predictability, agents offer neither. Sitting down with Nancy and Dev, Travis said that the only way to secure agents is to design secure-by-default workflows so that when they inevitably misbehave, the damage is contained. Security can pick winning battles Security teams are still grappling with how to classify and manage agent identities, but businesses aren't waiting to adopt AI and agentic tooling. The 1Password Access-Trust Gap Report found that 73% of employees are encouraged to use AI for some part of their workload. But policy enforcement clearly isn’t keeping up, since 37% say they only follow company AI policies "most of the time." Travis embraces speed as a simple fact of the modern tech business model. "Security teams exist to serve the business. Your job is to do the best risk minimization that you can within the amount of slowdown that a business will tolerate. I'm in ‘ship, ship, ship.’ I want the company to thrive," he said. Moving at the speed of business means that security teams often have more on their plates than they can achieve, and in that situation, the fights worth choosing are the ones that can be automated. Travis has found success in embedding security policy as code because LLMs can generate, review, and deploy it without a human in the loop. With LLMs, production no longer hits a human bottleneck. "We have these wonderful tools that operate very well on anything text-based," he said. "If you can do configuration as code, the LLM can produce it, independent LLMs can review it, and once everything's good, it just gets auto-deployed." When systems operate in a secure-by-default mode, security travels with the code, and teams can work without a checkpoint slowing them down. The 1Password Hook for Cursor is part of this approach because it embeds security at the credential layer. Secrets are available to Cursor only when needed, in memory, never written to disk or Git history. Access is controlled by design, and teams can work without worrying about accidentally committing secrets. Did we ever trust developers to begin with? The concept of least privilege was designed to reduce risk. Give any principal the minimum access they need so when something goes wrong, the damage is limited. "Developers weren't mega-trusted in the first place," Travis says, "not because they're bad people, they just have other priorities." Agents are no different. They're executing a task, not managing their own access. The non-deterministic nature of agents makes a least-privilege approach essential, because something will eventually go wrong. I still think people don't understand how non-deterministic these systems are… An agent could behave exactly as expected across dozens of runs and then do something completely different for no apparent reason. You always have to treat an individual agent as untrusted, especially if it has access to something that really matters." –Travis McPeak, Head of Security, Cursor Agents also process external content like emails, documents, and tool responses, and an attacker who controls that content can embed instructions the agent will follow as if they came from its legitimate operator. This is the architectural problem that made SQL injection effective, there was no boundary between the developer's instructions and user input. Prompt injection works the same way; there's no wall between an agent's instructions and the content it processes. "We never got the separation of control plane and data plane right in the history of computers," Travis said. "We set up the agent in a hurry because it's gonna be so cool, and we forgot to put safeguards, guardrails, logging, anomaly detection." With agents, a missing guardrail doesn't stay in one transaction. It executes automatically, across every run, at machine speed. Where traditional IAM falls short Traditional IAM has been a relatively successful permissions system for human identity management, but it’s not without limitations. "It's a great technology, honestly. Probably the bes

Extras afișat conform termenilor RSS ai publicației · 152 cuvinte · textul integral și figurile sunt pe site-ul publicației