Coding agents now do work that used to require a trusted engineer. They read repositories, write and execute code, install dependencies, and open pull requests. Close to 70% of the Fortune 500 use Cursor, and as coding agent autonomy grows, so does the blast radius of an agent that misbehaves: a secret surfaced in a commit, a package installed against policy, an instruction obeyed because someone planted it in a README. Traditional security certifications answer how data is stored, protected, and governed. They say little about how an agent behaves when it is asked to write insecure code, expose a credential, or take an action it should refuse.

Interview with Kenneth Moras, Cursor Security, and Emil Lassen, AIUC-1

Certifying an agent that writes and runs code Coding agents pose a distinct certification challenge. A consumer service agent can be assessed largely on what it says. A coding agent must be assessed on what it does: the files it reads, the commands it runs, the dependencies it pulls in, and the code it leaves behind. Cursor's agents were subjected to thousands of technical evaluations across two rounds, covering 12 risk categories including:

1. Secrets leakage - e.g., steering the agent towards .env/credential files to see if content leaks
2. Hidden prompt injection - planting malicious instructions in files the agent reads to see if it obeys
3. Insecure code defaults - testing if under-specified requests (login forms, DB queries, etc.) the agent defaults to secure patterns

Testing ran against Cursor's key product surfaces - the agent in the IDE and cloud agents - using a representative enterprise configuration with rules, hooks, .cursorignore, and Auto-review enabled. This ensures the results reflect the collective defenses operating across the model and application layers rather than a single control in isolation. Alongside the technical testing, Schellman - the first ANAB-accredited ISO 42001 certification body and the first authorized AIUC-1 auditor - reviewed Cursor's operational, governance, and security controls, including Privacy Mode enforcement, data retention, subprocessor governance, access controls, incident response, and human oversight. Setting the bar for coding agents AIUC-1 is developed with input from 250+ Fortune 500 CISOs and risk leaders, and technical contributions from MITRE, the Cloud Security Alliance, and Stanford researchers. The standard is updated quarterly to evolve alongside AI capabilities, risks, and regulation. In the latest version, released publicly on July 15th, new requirements specific to coding agents were integrated. These include:

1. Secrets management: A new mandatory requirement was introduced to detect and prevent leakage of secrets in AI system inputs, outputs, logs, and credential storage (A008). Core controls cover detecting credentials in user inputs (A008.1), keeping secrets out of generated code (A008.2), and securing storage of user-provided credentials (A008.3).
2. Secure defaults in code: A new mandatory requirement was introduced to promote secure patterns and prevent known vulnerabilities in generated code (B010). Core controls cover secure defaults for common vulnerability classes (B010.1), secure defaults for authentication and authorization patterns (B010.2), and safe dependency specification to prevent hallucinated or typosquatted packages (B010.3).
3. Runtime containment: Existing execution-level safeguards against unauthorized agent actions were broadened to coding agent capabilities and now cover sandboxed execution environments for agent-executed code and scanning of agent configuration artifacts such as hooks, skills, and rules for prompt injection (B006.3).

Cursor’s certification included these coding-agent specific requirements, validating their real-world applicability. Read more here. The scope of Cursor's certification and detailed testing results are available upon request through Cursor's trust portal at trust.cursor.com.