How Cursor gives engineers and AI agents secure access with Formal

“With Formal, we can finally manage least privilege access across our entire infrastructure through a single control plane.”

— Tom Daniels, CISO @ Cursor

What was Cursor trying to protect?

Cursor’s most sensitive assets are its model weights, its training data, and the infrastructure behind them. Yet researchers need to move and use that data across systems for training, reinforcement learning, and evaluation, and engineers increasingly work alongside agents that need access to internal systems to be useful.

To control that access, Cursor’s security team took a proxy-based approach: put a control point between every identity and the systems it reaches, so access can be inspected and enforced at the connection. They built their own proxies to do it.

The approach was right, but the homegrown proxies were hard to maintain and hard to scale. Cursor needed proxies that could:

• Give engineers and agents access appropriate to their work.
• Enforce granular controls across different technologies.
• Understand which identity was responsible for an action.
• Reduce standing access while keeping essential workflows available.

Building and maintaining that in-house, across every technology and workflow, was more than the security team wanted to own.

Why did Cursor replace its homegrown proxies with Formal?

With Formal, Cursor kept the proxy approach it already trusted and replaced its homegrown proxies with a more powerful one that covers more use cases. Formal’s protocol-aware proxy understands the requests flowing to downstream systems, allowing the security team to inspect activity and enforce policies within the connection.

That combination of visibility and control makes least privilege practical across a diverse environment:

• Granular enforcement. Policies can restrict access and apply conditions even where existing permissions are broader than the task requires.
• Consistent controls for people and agents. A configurable policy engine governs both, including workflows where an agent acts on a person’s behalf.
• Coverage across the stack. The same platform supports infrastructure, databases, and internal services, including SSH, PostgreSQL, Redis, ClickHouse, and Kubernetes.

The result is a single place to express and enforce the conditions under which access is allowed, with visibility into the activity that follows.

“Too many security products are really smoke and mirrors. They look pretty, they check a bunch of boxes, they say they can solve all the problems for you — but when you get below the surface a little, they don’t work as advertised, there are a bunch of problems, and the team behind them isn’t responsive. What I love about Formal: while it’s very powerful and does a lot of things, when you actually dig, it does those things.”

— Travis McPeak, Head of Security @ Cursor

How did Cursor give AI agents access to sensitive data safely?

For Cursor’s internal Cloud Agent workflows, useful access means more than being able to read a repository. Employees want agents to work with the data and services needed to complete real tasks.

Cursor combines isolated environments and tightly restricted outbound connections with scoped Formal policies on data. In ML environments, Formal sits between the environment an agent operates in and the sensitive data it needs, so the security team decides what agents access and sees what they do with it.

“Without Formal, we couldn’t have agents with access to sensitive data. With Formal, because we are able to inspect all traffic and enforce controls, we are able to provide a safe environment for the agents to get the job done.”

— Travis McPeak, Head of Security @ Cursor

How did Cursor tie an agent’s actions to a user?

Cursor’s Cloud Agents connect through a dedicated Formal identity with limited access. End-user identity propagation adds the employee who started the task, so the security team controls two things: what the Cloud Agent workflow can reach, and what that employee is allowed to do.

“We’ve limited the amount of data that those cloud agents can access and we’re able to tie that back to the specific user who is using that cloud agent, which is a feature that I’m only aware of Formal having.”

— Roy Xu, Software Engineer, Security @ Cursor

What changed for Cursor after deploying Formal?

Formal secures thousands of resources across 10+ technologies at Cursor, including SSH, PostgreSQL, Redis, ClickHouse, and Kubernetes. The deployment handles approximately 40 million logs and 600,000 sessions per week.

Before Formal, Cursor did not connect its Cloud Agents to internal systems. There was no way to limit what an agent could reach or to tie its actions back to a person, so the risk was too high. With Formal in the path, Cursor’s agents now access internal systems securely.

• Agents connected to internal systems. Cloud Agents now work with internal data and infrastructure that was previously off limits. Formal inspects every request and scopes it by policy.
• No standing production access. Engineers request just-in-time access for a specific operational need instead of holding permanent production permissions.
• One control layer instead of many. Policies and audit logs for SSH, PostgreSQL, Redis, ClickHouse, and Kubernetes live in one place, instead of in homegrown proxies the security team had to maintain.

What’s next for Cursor and Formal?

Cursor plans to use Formal for broader visibility and guardrails around agent use across the company. As agents take on more autonomous work, the goal is to open up more workflows while every action stays scoped by policy and tied to a person.

Products Used