Referring to Auto-review Run Mode it seems like Cursor probably works like Claude’s auto-mode and only appends the previous user prompts (and additionally gives the auto-reviewer tool use inside of a sandbox), but I want to confirm that this is the case. The chance of a prompt injection happening with an approach like OpenAI’s Codex’s “Approve for me” seems much higher given that it includes the previous results of tool calls and LLM outputs (even if in a summarised form) and I want to clarify where Cursor’s implementation sits
Hey, thanks for the request. Your intuition is basically right, Cursor is closer to the approach you described for Claude than to Codex “Approve for me”.
The auto review classifier is intentionally given minimal context: your current request which is the trusted intent source, your custom instructions from .cursor/permissions.json autoRun.allow_instructions and block_instructions, and the proposed tool call itself command plus arguments. It does not see previous tool call results, no shell output, no file contents, no MCP results, no loaded web content, not even in summarized form.
One small nuance that’s worth being upfront about: some recent conversation may be included in context, but only as untrusted data for analysis, not as instructions to execute. It can’t authorize an action by itself. The only trusted sources of instructions are your own requests and permissions.json. The reviewer’s own tool use is read only workspace inspection reading files and directories, not executing anything.
Important caveat from the announcement https://forum.cursor.com/t/auto-review-run-mode/161922: the classifier is nondeterministic and best effort, so it’s not a hard security boundary. For strict control, use an allowlist and explicit rules in permissions.json, see security hardening Security and Privacy Hardening | Cursor Docs. Let me know if you want me to clarify anything.