Cursor AI Features
AI-native editing features
Last reviewed
Recommended
Cursor AI Features — Timed Test 4 (10 questions)
No account needed. Answers and explanations arrive when you submit.
What this topic tests
The mix every Cursor AI Features set is built to, and the questions published against it so far. Nothing here is hidden before you start.
| Level | Target share | Published |
|---|---|---|
| Easy | 40% | 20 |
| Medium | 40% | 20 |
| Hard | 20% | 10 |
| Total | 50 |
Cursor AI Features — the theory
Three Ways To Get Code, And When Each Is Wrong
Cursor gives you three distinct ways to have the AI write code, and most wasted time comes from reaching for the wrong one.
Tab is inline autocomplete. It is not a plain completer: it suggests code as you type, based on your recent edits, surrounding code, and linter errors. That means it follows intent you have already demonstrated, which is why it performs badly in an empty file — a new or empty file gives it less to work with. A suggestion is only ever a proposal until you take it, because suggestions appear as grayed-out text ahead of your cursor.
Two behaviours repay knowing. A single suggestion is not limited to the current line — Tab can modify multiple lines, add missing import statements, and suggest coordinated edits across related code. And after you take one, press Tab again. Tab predicts your next editing location and jumps there, including into another file, where a portal window appears at the bottom of the editor.
Inline Edit is the middle option: it lets you make quick, targeted code changes without opening the chat panel, and it is iterative — to refine, add follow-up instructions and press Return again. It acts on your selection, so a change that must span files is the wrong job for it.
Agent is the one that does real work, and the rest of this topic is mostly about it.
What An Agent Actually Is
An agent is not a model. It is instructions, tools and a model together, and Cursor tunes the first two per model — Cursor's agent orchestrates these components for each model we support, tuning instructions and tools specifically for every frontier model. When output is poor, the part you control is usually the instructions, not the model picker.
An agent works until the job is done rather than within a budget: there is no limit on the number of tool calls Agent can make during a task. It does not idle when it asks you something — while waiting for your response, the agent continues reading files, making edits, or running commands — and you do not have to wait for it either. You have two ways to talk to an agent while it works. Queue a message and it waits for the current task to finish.
The most important sentence for a newcomer is about when changes land: Agent's edits are applied as it works. Review them in the diff view and reject anything you don't want. There is no approve-before-write gate on file edits. The safety net is a checkpoint: Agent automatically creates them before making significant changes, capturing the state of all modified files. But it is a local undo and nothing more: checkpoints are stored locally and separate from Git. Only use them for undoing Agent changes; use Git for permanent version control.
The Modes Are Different Permissions, Not Different Tones
Ask mode is a read-only mode for understanding your codebase — the agent answers questions and explores code without making any edits. When the question turns into work, switch back to Agent mode; it will not escalate itself.
Plan Mode researches first: Agent researches your codebase, asks clarifying questions, and generates a reviewable plan you can edit before building. The plan is a document you change, not a preview you accept, and it lives outside the repo — plans are saved by default in your home directory. Plan Mode is not a universal safety upgrade: for quick changes or tasks you've done many times before, jumping straight to Agent mode is fine. When a build goes wrong, the recommended recovery is counter-intuitive and worth trusting — instead of trying to fix it through follow-up prompts, go back to the plan, because this is often faster than fixing an in-progress agent, and produces cleaner results.
Debug Mode trades speed for evidence. Instead of immediately writing code, the agent generates hypotheses, adds log statements, and uses runtime information to pinpoint the exact issue before making a targeted fix. It is not autonomous — Debug Mode asks you to reproduce the bug and provides specific steps — and the cleanup is conditional on finishing: once confirmed, the agent removes all instrumentation.
One cross-cutting fact catches people out: each mode uses its own context, so switching modes starts a fresh context window. Exploring in Ask and then flipping to Agent with "now build what we discussed" reaches an agent that was not there. Rules, by contrast, travel everywhere — project rules, user rules, and team rules apply in Agent, Ask, Plan, and Debug modes.
Running More Than One Agent
A subagent is an isolated worker: each subagent runs in its own context window and returns a result to the main conversation, and crucially the parent agent includes relevant information in the prompt since subagents don't have access to prior conversation history. Isolation is the feature and the price. It is not, however, isolation of authority — subagents inherit all tools from the parent, including MCP tools from configured servers — and nesting is capped: the main agent and its direct subagents can launch subagents, but a subagent launched by another subagent can't launch further ones.
Parallel agents editing one checkout collide, which is what worktrees exist for: they let Agent work in isolated Git checkouts. Each task gets its own files, dependencies, and changes while your main checkout stays untouched. Two warnings come with them. We do not recommend symlinking dependencies into the worktree, and they are not permanent — cleanup runs on an interval and keeps the newest worktrees up to the configured machine-wide maximum count across every workspace on the device.
A side chat is the lightweight option for a question you do not want polluting the main thread. It is seeded invisibly — the parent's conversation history is copied in as reference context for the model. That history does not appear in the side-chat transcript — and it is deliberately not a second agent: by default, side chats focus on reading, searching, and answering.
The Guardrails, And What They Do Not Cover
Cursor is explicit about why the approval prompts exist: AI can behave unexpectedly due to prompt injection, hallucinations, and other issues. Run Modes decide how much runs unattended, and their coverage is narrower than the name suggests — auto-review applies to shell, MCP, and Fetch tool calls, which leaves file edits outside it entirely: agents can modify workspace files without approval, except for configuration files. Changes save immediately to disk.
The review step is a model, and the documentation says so plainly: the classifier can make mistakes. It can allow a call you would have blocked, or block a call you would have allowed. The sandbox has a matching gap — commands that need full system access, like writes outside the workspace or privileged operations, can't be sandboxed, so they go to the classifier instead. The riskiest commands are exactly the ones it cannot contain.
Two defaults are worth keeping. Agents cannot make arbitrary network requests with default settings, and MCP trust is per call, not per connection: after you approve an MCP connection, each tool call still needs individual approval before running.
Finally, if you share a session, know what leaves with it. The full conversation history is shared, including code snippets, tool calls, and their results, and the scrubbing is best-effort: redaction is not guaranteed and can miss secrets.
Where to Go Next
Cursor Basics covers everything this page assumes is already working: installing, migrating, rules, ignore files, skills, configuring MCP and what the usage meter actually counts. AI Agents Basics covers agent architecture in general — the concepts underneath modes, tools and delegation, none of which are Cursor's invention. And Claude Code Workflows shows delegation and subagents worked out in a different tool, which is the fastest way to see which behaviour here is Cursor and which is the shape of the idea.
Sample questions
Three questions from this topic, with the answer and the reasoning shown.
Q1EasyA background subagent finishes an investigation, and an hour later a follow-up question about its findings comes up. What does Cursor make possible?
- Only starting a fresh subagent, since a completed one is torn down along with everything it had gathered.
- Resuming that subagent by its agent ID and continuing the conversation with the context it built preserved.Correct
- Re-issuing the identical prompt, which rebuilds exactly the same context before the follow-up is put to it.
- Reading back the returned summary alone, because a subagent holds its state in memory and loses it on exit.
Explanation
The principle — Each subagent execution returns an agent ID, and background subagents write their state to disk as they go. A finished subagent is a conversation you can pick up again, rather than a call that has already returned.
Why the key is correct — Passing that ID back resumes the subagent with its context intact, so the follow-up lands on an agent that already knows the paths, the dead ends and the findings.
Why the others are wrong — Starting fresh is possible but wasteful, since completion does not discard the state. Re-issuing the original prompt reproduces neither the exploration nor the saving. And the state is persisted rather than held in memory, so the returned summary is far from all that survives.
Remember this — Keep the agent ID; a completed subagent resumes with its context.
Sources — Cursor's Subagents documentation.
Q2EasyA colleague on a legacy request-based plan switches Max Mode on before asking a question. What does that setting actually change?
- It substitutes a stronger variant of the model, so the same question comes back with deeper reasoning.
- It extends the context window past the default, so a single request can hold more material.Correct
- It widens how much of the project the editor indexes, so searches across the codebase return more results.
- It lifts the per-message rate limit, so longer runs of requests can be sent with no waiting between them.
Explanation
The principle — Max Mode is available only on legacy request-based plans, and it extends a model's context window beyond the default limit. That is the whole mechanism. It also stays on across conversations once enabled, so it behaves as a default rather than a per-chat choice.
Why the key is correct — A bigger window means more code, more files and more conversation can be in view for one request. Nothing about the model's reasoning changes.
Why the others are wrong — It does not swap in a more capable model, it has no bearing on how much of the project is indexed for search, and it is not a rate limit control.
Remember this — Max Mode is a bigger window, not a better brain — and it stays on until you switch it off.
Sources — Cursor's Max Mode documentation.
Q3EasyA colleague writes every prompt as numbered micro-steps, as though driving a code generator, and wonders why it takes so long. What does a coding agent do with a plain-language goal instead?
- It expands your goal into a numbered plan and then waits for you to carry out each step in the editor.
- It returns one best answer as a code block, leaving the file changes and any commands entirely to you.
- It searches the codebase for comparable code and offers snippets, which you adapt and then apply file by file.
- It plans the work itself, edits files, runs commands and checks its own results against the goal you described.Correct
Explanation
The principle — A coding agent writes and changes software on its own. You describe a goal in plain language; the agent plans the work, edits files, runs commands and checks its own results.
Why the key is correct — Planning, editing, running and verifying are the agent's job, which is why a useful prompt states the outcome and its constraints. Micro-steps waste the part that plans.
Why the others are wrong — Writing a plan for you to execute describes a hand-off that does not happen; the agent does the work even when the approach is reviewed first. Returning a snippet to paste describes an assistant that answers rather than acts. Codebase search is one tool feeding the next edit, not the deliverable.
Remember this — Give the agent the destination and the constraints; let it choose the route.
Sources — Cursor's coding agents help documentation.
Practise all 50 questions
Every published question in Cursor AI Features, with its answer and explanation.
- A background subagent finishes an investigation, and an hour later a follow-up question about its findings comes up. What does Cursor make possible?easy
- A colleague on a legacy request-based plan switches Max Mode on before asking a question. What does that setting actually change?easy
- A colleague writes every prompt as numbered micro-steps, as though driving a code generator, and wonders why it takes so long. What does a coding agent do with a plain-language goal instead?easy
- A long CI-fixing task is handed off from a local Cursor session to a cloud subagent. Where does that work actually happen?easy
- A newly opened side chat shows an almost empty transcript. What does the model answering in it have to work from?easy
- A plan produced in Plan Mode has been reviewed and built, and a teammate now wants to read it on the branch. Where does Cursor keep that plan by default?easy
- A wide refactor has Agent reading and editing dozens of files and it is still going after many steps. What limits the number of tool calls it may make within this one task?easy
- A workflow depends on asking side questions of a long-running Cloud Agent without interrupting its main thread. What should be expected today?easy
- Agent is midway through a long migration and you already know the two follow-up steps you want after it. What can you do with the chat input right now?easy
- Agent is partway through a task in your repository when a command it ran fails. Given no further instruction from you, what happens next?easy
- Ask mode is a read-only mode for understanding a codebase. According to Cursor, what should happen once a question in Ask mode turns into an actual code change?easy
- Cursor applies best-effort redaction for known secret patterns before a transcript is shared. What does that leave the person sharing it responsible for?easy
- Cursor requires your manual approval for sensitive agent actions by default. What is that requirement primarily defending against?easy
- Halfway through a task, Agent asks you a clarifying question about which of two schemas to target. You step away for ten minutes before answering. What is Agent doing meanwhile?easy
- Midway through an edit, a small portal window appears at the bottom of the Cursor editor. What is it offering you?easy
- Several subagents are still running in a parent thread when a side chat is opened from it. What carries over into the side chat?easy
- Someone keeps an extended context window switched on permanently, treating it as a safety margin for every task they run. What is the cost of that habit?easy
- Which of the following does a shared Cursor transcript leave out?easy
- You reason through a tricky architecture question in Ask, then switch that chat to Agent and say "now implement what we just discussed". How much of the discussion does Agent have?easy
- You start a long Agent run on a working tree that already holds an hour of uncommitted changes, then leave your desk expecting to approve the edits in the diff view when you get back. What state are your files in while you are away?easy
- A developer cycles the chat input with Shift+Tab looking for Design Mode, finds only the other modes, and concludes the feature is missing from their build. What is actually the case?medium
- A developer shares a public link to a Cursor chat in order to show a colleague one clever refactor near the end of it. What else does that link publish?medium
- A project defines a subagent named `reviewer` in both `.cursor/agents/` and `.claude/agents/`, and edits to the file under `.claude/agents/` make no difference to how the subagent behaves. What explains that?medium
- A repository requires the Bugbot check in branch protection, and Bugbot posts several findings on an open pull request. What happens to the merge?medium
- A team is unhappy with the code an agent produces and has worked through every model in the picker without much change. Which account of how Cursor assembles an agent explains where the remaining leverage sits?medium
- Agent delegates a large dependency audit to several subagents and reports back a summary. You then ask the same chat about a specific configuration file one subagent opened, and it has no knowledge of the file at all. What accounts for this?medium
- An orchestration design has a coordinator launch team-lead subagents, and each team lead launch worker subagents of its own. What should be expected when it runs in Cursor?medium
- Debug Mode has explored the failing area, formed its hypotheses and added log statements, and the run then stops making progress on its own. What does Cursor's documented flow expect at this point?medium
- Deep into one very long chat, you notice that a constraint you stated in your opening message is quietly being ignored. Knowing how Cursor handles a context window that is filling up, what is the likeliest explanation and the sensible response?medium
- Design Mode is open in the Agents Window browser and an agent is midway through a spacing change when a second problem becomes obvious elsewhere on the page. What does Cursor say about sending that second edit straight away?medium
- Grey text has appeared ahead of your cursor showing a completion you have decided against. Which description of the file's current state, together with the right way to move on, is accurate?medium
- How should a developer treat a shell command that the Auto-review classifier allowed to run without prompting?medium
- Minutes into a Debug Mode run on a hard-to-reproduce bug, log statements appear across several files and no fix has been written. How should a developer read what they are seeing?medium
- Partway through a component you begin calling a date-formatting helper that lives in another module and has never been imported into this file. Tab offers a suggestion covering the call. What can that single accepted suggestion reasonably do?medium
- Several rounds of ordinary Agent-mode prompting have produced plausible patches for one bug, each changing behaviour without resolving it. What does Cursor identify as the difference Debug Mode brings to this situation?medium
- Why does widening an agent's network access, whether through Allow All in the sandbox or an MCP server that fetches arbitrary URLs, materially change the impact of a prompt-injection attack?medium
- Working inside a side chat opened off a long investigation, a developer types `/side` again to branch the exploration further. What happens?medium
- You accept a Tab suggestion that changes a function's signature. The same function is called in three more places further down the file, and each one now needs the same treatment. Without touching the mouse, you press Tab once more straight after accepting. What should you expect?medium
- You ask the agent to find every place user input is validated. It spawns an Explore subagent, which reports back, and the agent then proposes an edit to one validator file. Before accepting, you want to know whether the main agent has actually seen that file's contents. What did the subagent hand back?medium
- You let the agent read a handful of unfamiliar web pages with a fairly permissive browser allow list in place. Partway through it attempts a form submission on one of those pages that you never asked for and that appears nowhere in your prompt. What is the likely explanation, and what should change?medium
- A developer has made Plan Mode the default for every request, including one-line copy fixes and renames they have done dozens of times. Each of those small tasks now costs a round of clarifying questions and a plan review before any code is written, and the team has started avoiding planning altogether because it feels slow. What does Cursor's guidance say about this habit?hard
- A developer switches browser tools to auto-run so a long UI regression run stops interrupting them for approvals. With that still set, they ask the agent to go and read an unfamiliar third-party vendor's site and gather integration details. Why is the second task the one that should worry them?hard
- A security reviewer holds up codebase indexing for your team. Their objection is that directory and file names across the repository carry internal project and client names, and they assume those names travel to Cursor's servers as readable text. Which description of what actually leaves the machine should you take into that review?hard
- After Debug Mode cracked a stubborn race condition last week, a developer now starts every task in it. Today's task is a validation rule they can already name, in a file they can already point at, and the session opens by adding log statements and asking them to reproduce a failure. Which choice matches Cursor's stated division between these two modes?hard
- An agent run installs dependencies and then runs your integration tests. The install dies on a network error and one test fails writing a cache file into your home directory, yet Cursor asked you to approve neither command and both ran to completion in your terminal. Your Run Mode put both into the sandbox. What best explains the two failures?hard
- An enterprise administrator switches on the Browser Origin Allowlist in the dashboard, adds no entries, saves the configuration, and announces to the organisation that agent browsing is now confined to approved sites. Auditors take the announcement at face value. What is the real state of automatic navigation?hard
- Two developers chase the same bug. One asks the agent to look at whatever is wrong with the payment retry logic; the other writes that PaymentFailedError is thrown twice on retry inside PaymentService. The second run lands on the offending lines in a fraction of the steps. What accounts for the gap?hard
- You are widening a helper's signature with an extra argument. You have already updated two call sites by hand in the same file, and the linter is now flagging a third call site as passing too few arguments. You put the cursor in that third call site and Tab immediately offers a well-shaped completion. Earlier the same day, the same helper name in an empty scratch file produced nothing useful. What best accounts for the difference?hard
- Your organisation's browser origin allowlist holds one entry, your internal documentation host. Mid-task the agent clicks a link on that host pointing at an external vendor site, and the page loads. Your compliance owner files it as a product defect and asks you to confirm. How should you characterise what happened?hard
- Your team switches a project to Auto-review, and an agent finishes a twenty-step task having interrupted you exactly once. A colleague concludes that the classifier examined and cleared the other nineteen calls. What actually happened to them?hard
Frequently asked
What people ask about cursor ai features.
Why are Tab's suggestions poor in a brand-new file?
Does Agent ask before it changes my files?
I explored a problem in Ask mode, switched to Agent, and it had forgotten everything. Why?
Agent built the wrong thing from my plan. Should I correct it in chat?
If I turn on sandboxing, is everything the agent runs contained?
What exactly is exposed when I share a transcript?
More Cursor topics
Related guides
How it works · 10 min read
What Cursor actually looks at when you ask it something
Indexing says synced, the file is open, and Cursor still answers as if your code does not exist. Follow one request end to end: what gets attached, what gets injected, what the agent decides to search for, what three ignore files remove, and what gets compressed away.
How it works · 11 min read
It followed your example instead of your instruction
You wrote the rule, then pasted an example under it to help — and the output matched the example. A demonstration is a stronger signal than a description, it shows everything about itself rather than the one property you meant, and nothing warns you when the two disagree.
Troubleshooting · 8 min read
Why Cursor is ignoring your rules file
A rule that sits in .cursor/rules and does nothing fails silently, and Cursor publishes no way to see which rules were applied. Ten causes with distinct fingerprints: the type you get by leaving fields blank, the .md that is invisible, and the team rule that outranks you.