Vulnerability Scanner agent — Environment selection silently reverts to "Cloud" after saving a self-hosted Pool

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Somewhere else…

Describe the Bug

When creating a Vulnerability Scanner background agent, the Environment dropdown offers both Cloud and Pool (Self-hosted). Selecting a self-hosted Pool and saving appears to succeed, but the setting silently reverts to the default Cloud option. This contradicts the documented behavior.

Steps to Reproduce

Steps to reproduce

  • Open cursor.com/dashboard/security-review → Add new Security Review Agents → Vulnerability Scanner
  • Under Environment → “Choose where Cloud Agent runs”, open the dropdown.
  • Select Pool (Self-hosted) and pick one of the available pools.
  • Save the agent.
  • Reopen the agent’s settings.

Actual
The Environment field is back to Cloud. No warning, no error — the self-hosted selection is silently dropped.
Why this matters
The official docs at Security Agents | Cursor Docs explicitly state that self-hosted Cloud Agents are a supported option for Security Review:

“You can use Cursor’s cloud with no additional setup, or configure self-hosted Cloud Agents to run reviews in your own environment.”

For teams that need source code to stay inside their own infrastructure (compliance, NDA, IP-sensitive repos), this silent fallback to Cursor Cloud is a meaningful problem — users believe they configured a self-hosted run, but scans actually execute on Cursor Cloud.

Expected Behavior

The Environment field shows the self-hosted Pool that was selected, and scheduled scans run in that environment.

Screenshots / Screen Recordings

Operating System

MacOS

Version Information

Web

Does this stop you from using Cursor

Yes - Cursor is unusable

7

Thanks for the report @Hung_Hoang_Le! This matches closely an existing issue that I thought was fixed. Following up with the team.

8

hi @Colin , any update so far ?

9

Hi Hung!
We recently shipped a fix for a closely related issue where self-hosted pool settings weren’t displaying correctly, but we’re still verifying whether it fully covers the Vulnerability Scanner/Security Review page specifically. I’ll follow up here once I have confirmation from the team.

10

Hi, I have tested and the issue is still there. Please help to follow up with the relevant team @mohitjain

11

Thanks for confirming. We’ve identified the remaining issue. We’ve flagged this with the engineering team and they’re aware. I’ll follow up once a fix is in place.

12

@Hung_Hoang_Le - a fix for this has been deployed. The self-hosted Pool selection on the Security Review / Vulnerability Scanner page should now persist correctly after saving.

Could you try setting up your Vulnerability Scanner with a self-hosted Pool again and confirm the Environment sticks after saving?