Cursor adds a PR security scanner and a deploy-watching Rollouts bot
Both bots self-serve the risky last mile of shipping agent-written code — the same day GitHub Copilot ships a local sandbox to fence your agent in.
Copy markdown
Security Review reads every PR for exploitable bugs
Cursor's new bot scans each pull request for injection (SQL, command, template), auth bypasses, credential leaks, SSRF, and unsafe deserialization, and you can add custom rules for your own standards. It's an always-on reviewer sitting between your coding agent and merge — on Teams and Enterprise, with roughly 50 review credits for Teams and 500 for Enterprise to start.
Rollouts watches the deploy, not the diff
The second bot reads a PR's diff and the systems it touches, writes a monitoring plan as a PR comment, then tracks deployment health across environments — flagging regressions and able to auto-revert a bad change. It extends oversight past merge into production, where most surprises actually surface. Same Teams/Enterprise gating.
Copilot can now sandbox your local agent
A new public-preview toggle limits the GitHub Copilot app's access to your filesystem, network, and Git/GitHub credentials, set per project — flip on "Sandbox new sessions" or type /sandbox on mid-session. It's default-off and local-only for now, but after a week of agents leaking whole repos and credentials, it's the containment switch to reach for.
Claude Code 2.1.281 adds lockdown knobs
The Sep 23 release wires in blockReadsOutsideWorkingDirectories and disableBypassPermissionsMode for managed setups, plus Bedrock assume_role and guardrail support, and an Auto-mode recommendation in /insights that estimates how many permission prompts you'd skip. Worth the update if you run Claude Code on a locked-down or Bedrock backend.