Last reviewed
Correct answer: A. As a best-effort judgement that can be wrong in either direction, so irreversible work still needs a human or an explicit block instruction.
Explanation
The principle — The Auto-review classifier is a best-effort guardrail, and Cursor states plainly that it is not a security boundary. It can allow a call you would have blocked, and it can block a call you would have allowed.
Why the key is correct — A model is inferring intent from the text of a command, and it errs in both directions. The false negative is the one that costs you: a destructive or data-exfiltrating command that reads as routine gets through, and on an unattended run there is nobody watching the terminal when it does. Treating the verdict as a judgement rather than a proof is what keeps a human, an allowlist, or a written block instruction in front of the operations you cannot undo.
Why the others are wrong — Calling the classifier a security boundary is exactly the belief the documentation exists to correct; guardrails limit what an agent does casually, they do not withstand an adversary who is shaping the input. Assuming the sandbox catches whatever the classifier permits gets the ordering backwards, because commands needing full system access cannot be sandboxed and are precisely the ones that reach the classifier. And it is not a deterministic rule set, so consistency across runs is not something to rely on.
Remember this — Fewer prompts is the feature; proof of safety is not part of the deal. Decide in advance which operations you always want to see, and write those into your block instructions so the decision does not depend on a model's mood.
Sources — Cursor's Run Modes documentation.
Sources
“The classifier can make mistakes. It can allow a call you would have blocked, or block a call you would have allowed.”
Practise 10 questions on this topic
Take Cursor AI Features — Timed Test 1 (10 questions) — scored instantly, explanation for every question, no login.