When creating a Vulnerability Scanner background agent, the Environment dropdown offers both Cloud and Pool (Self-hosted). Selecting a self-hosted Pool and saving appears to succeed, but the setting silently reverts to the default Cloud option. This contradicts the documented behavior.
Under Environment → “Choose where Cloud Agent runs”, open the dropdown.
Select Pool (Self-hosted) and pick one of the available pools.
Save the agent.
Reopen the agent’s settings.
Actual
The Environment field is back to Cloud. No warning, no error — the self-hosted selection is silently dropped.
Why this matters
The official docs at Security Agents | Cursor Docs explicitly state that self-hosted Cloud Agents are a supported option for Security Review:
“You can use Cursor’s cloud with no additional setup, or configure self-hosted Cloud Agents to run reviews in your own environment.”
For teams that need source code to stay inside their own infrastructure (compliance, NDA, IP-sensitive repos), this silent fallback to Cursor Cloud is a meaningful problem — users believe they configured a self-hosted run, but scans actually execute on Cursor Cloud.
Expected Behavior
The Environment field shows the self-hosted Pool that was selected, and scheduled scans run in that environment.
Hi Hung!
We recently shipped a fix for a closely related issue where self-hosted pool settings weren’t displaying correctly, but we’re still verifying whether it fully covers the Vulnerability Scanner/Security Review page specifically. I’ll follow up here once I have confirmation from the team.
Thanks for confirming. We’ve identified the remaining issue. We’ve flagged this with the engineering team and they’re aware. I’ll follow up once a fix is in place.
@Hung_Hoang_Le - a fix for this has been deployed. The self-hosted Pool selection on the Security Review / Vulnerability Scanner page should now persist correctly after saving.
Could you try setting up your Vulnerability Scanner with a self-hosted Pool again and confirm the Environment sticks after saving?
Thanks for flagging this, Hung. This is a new regression separate from the original issue — a recent UI update inadvertently removed the environment selection section on the Security Review page. I’ve flagged it with the engineering team and will follow up here once it’s resolved.
Hey @Hung_Hoang_Le,
The environment selection regression has been addressed in a recent Cursor update. Could you update to the latest version and let me know if the Pool setting persists correctly now?
