Your team switches a project to Auto-review, and an agent finishes a twenty-step task having interrupted you exactly once. A colleague concludes that the classifier examined and cleared the other nineteen calls. What actually happened to them?

The principle — Auto-review is a pipeline rather than a single gate. It applies to shell, MCP and Fetch tool calls, and it checks each one in a fixed order: allowlisted calls run immediately, other shell commands run in the sandbox when the sandbox can take them, and only the remainder is sent to the classifier. Over a long run, most calls never reach the classifier at all.

Why the key is correct — The nineteen silent calls were silent for two different reasons, and the distinction matters. Some matched the allowlist and ran with no review of any kind. Others were shell commands the sandbox could accept, so they ran under its file and network limits, again without classification. Sandboxing is a layer on top of the mode: it controls where a supported terminal command runs, not whether the mode uses the classifier. The single prompt is the tail of the distribution, not a sample of it.

Why the others are wrong — Believing the classifier saw all nineteen inverts the design, because the classifier is the fallback for calls the earlier steps could not absorb; the more allowlisted and sandboxable work a run does, the smaller the share that is inspected. Treating sandboxing as a replacement for classification misses the commands that cannot be sandboxed at all, such as writes outside the workspace or privileged operations, which are exactly the ones routed to the classifier and, if it declines and the agent still insists, to you. And nothing is batched for review at the end; each call is decided before it runs.

Remember this — The commands the sandbox cannot contain are the ones with the widest reach, so containment and scrutiny land on opposite sets of calls. Note too that file edits sit outside this pipeline entirely and save straight to disk, which is why version control belongs underneath any autonomous run.

Sources — Cursor's Run Modes documentation.