Cursor's new bot follows each pull request into production

Rustam Lalkaka, who ran Firetiger before Cursor bought his team, says writing code is no longer the slow part. The slow part is everything after the pull request goes up, down to "figuring out which of eleven changes broke checkout."

As The New Stack reports, Cursor's answer is Rollouts, a bot that follows each change from pull request into production and checks whether it behaves as intended. It is the first product to come out of the Firetiger deal.

At a glance

• Cursor has launched Rollouts, a bot rebuilt from Firetiger's Change Monitors, alongside an upgraded Security Reviewer, and both are available in the Automations tab for Teams and Enterprise customers.
• When a pull request opens, Rollouts drafts a monitoring plan, then checks logs, metrics and traces after deploy and rates staging and production separately as verified healthy, regression detected or inconclusive.
• Rollouts does not merge fixes or roll back deployments on its own; it can pause a progressive rollout, open a revert pull request or hand the problem to a Cursor cloud agent.

If you have not been following: a little over a month ago SpaceX closed its $60 billion acquisition of Cursor, giving it access to SpaceX's GPU infrastructure for its own models. The day before, Cursor quietly bought the team behind Firetiger, a three-year-old startup building agents that monitor changes from pull request through deployment. Lalkaka argued then that agentic coding had cut the cost of creating changes to near zero, while the cost and risk of deploying them stayed largely the same.

Rollouts is Firetiger's Change Monitors, rebuilt on a new Cursor kit

Cursor rebuilt Change Monitors with the Bot Development Kit, an early-stage framework for building and serving Cursor bots and agents, published as the @cursor/bdk package on npm. Its documentation says developers define agents in Markdown and TypeScript, with support for tools, skills, subagents, webhooks and scheduled runs.

For source control, Rollouts connects to GitHub or to Origin, the Git-compatible code host Cursor launched in August. It pulls deployment events from continuous delivery systems and uses signals from Datadog and other telemetry providers. Cursor's cloud agents can already create branches, commit, push and open pull requests against Origin repositories, so Rollouts adds the missing half: what happened after the merge.

Security Reviewer now averages 3.8 minutes per review, down from 4.8

Security Reviewer first appeared in beta in April. At launch it inspected pull requests for security vulnerabilities, authentication regressions, privacy and data-handling risks, agent tool auto-approvals and prompt-injection attacks, leaving findings next to the relevant code. Like Rollouts, it can run automatically whenever a new pull request opens, so nobody has to remember to call it.

The new version reads each pull request in the context of the wider codebase, focuses on exploitable issues such as injection flaws and broken authentication, and returns a severity rating, an attack path and a proposed fix. Per Cursor, average review time fell 21%, from 4.8 minutes to 3.8, and developer acceptance of its comments rose from roughly 45–50% to 60–70%.

Security Review reads code the way a security engineer does. Where does user input enter, where does it end up, what does it pass through on the way.

Datadog, Harness and LaunchDarkly already verify deployments

Rollouts enters a crowded lane. Datadog's Bits Release, launched in preview in June, also follows changes from pull request into production and checks telemetry for regressions. Harness has long offered automated deployment verification and rollback based on logs and metrics, and LaunchDarkly's Guarded Rollouts can monitor feature releases for regressions and reverse them automatically.

Source control is contested too: Zed recently put Delta into public beta, with its own ideas about source control for teams that work heavily with agents. Announcing the Firetiger deal, Cursor's Maxime Prades called it part of a broader investment in long-running, autonomous, context-aware agents for teams, naming Origin and Change Monitors as examples.

Agents that write code should also be able to tell whether it works in production.

Every deployment gets one of three verdicts, judged separately in staging and production

Rollouts starts when a pull request opens. It reads the change, works out which systems could be affected and writes a plan: what the change should do, the risks it sees, the signals it will watch and any holes in the available instrumentation. Developers can review and edit that plan before the code ships.

After deploy, the bot checks logs, metrics and traces against the plan and issues a verdict for staging and for production independently. A change can pass in staging and still be flagged once it reaches production. Think of a doctor who writes down what a new prescription should change and which side effects to look for, then reads the blood work against that note.

On a regression, Rollouts can name the suspect change, alert the developer responsible and, depending on configuration, open a revert pull request or pass the problem to a Cursor cloud agent. Lalkaka says it already catches problems limited to one endpoint or region before they trigger a broader alert, and separates expected behavior changes from genuine regressions.

Every figure here comes from Cursor itself, and there is no published false-alarm rate for Rollouts, nor any count of how often it lands on inconclusive. In our view, the three-verdict design is the sensible choice, because a bot allowed to say "inconclusive" is easier to trust than one forced to pick healthy or broken. Against Datadog or LaunchDarkly, Cursor appears to be selling proximity: the coding agent, repository, security checks and production feedback in one place.

Feature flags are next on the list

Cursor lists a feature-flag integration as coming soon, which would let Rollouts directly adjust the traffic reaching a change, and says support for release trains and deployment freezes is in the works. No dates have been given for either. Origin is still early, with limited functionality, and Rollouts does not require it. How much of this loop Cursor pulls into its own forge remains open.