Building a Security Factory with Superagent and Cursor

Security testing has always had an awkward timing problem. We ship code continuously, but security reviews tend to happen at a different pace. Findings can take days or weeks to report, triage, assign, fix and review.

Internally, we use what we call the Security Factory: an always-on system where Superagent acts as the attacker and Cursor acts as the executor. Superagent continuously red-teams our agents and applications, looking for realistic paths an untrusted user could exploit.

The executor is an active Cursor Automation connected to our main application repository. A Superagent webhook triggers it whenever a new advisory is created. The advisory arrives with evidence, risk and remediation context, and Cursor can retrieve the complete finding through the Superagent MCP.

The automation follows a strict remediation gate. It must reproduce the reported behavior, check whether it crosses a meaningful security or tenant boundary, identify the access an attacker needs and confirm that the vulnerable path is reachable through a production interface. It should only remediate critical vulnerabilities that an untrusted third party can exploit through a realistic attack path.

This is not "AI found something, so AI changed production code." If the evidence is weak, the path is theoretical or the issue requires trusted internal access, Cursor does not open a pull request. If the vulnerability meets the threshold, it searches for existing work, creates the smallest complete fix and adds a regression test.

Cursor can open and comment on pull requests, request reviewers, use memories and report outcomes to Superagent. The PR still passes through our normal GitHub, CI and human review process. The automation prepares the work without bypassing that approval boundary.

This model removes the handoff. The attacker does not write a report that sits in somebody's inbox. A useful finding reaches an executor with the evidence and tools to act. Triage, reproduction, remediation and review become one continuous flow.

The effect shows up in our Security Factory board. Findings move from new, to triaging, to review, to resolved. We have seen high-severity issues go from discovery to a tested fix in minutes. A time delta once measured in weeks is now measured in minutes.

Every previous finding also becomes context for the next red-team run, so Superagent does not start from zero each time. It carries forward what we have already found and fixed, then looks for new ways around those defenses. As the product changes, the attacker changes with it.

For us, always-on security means finding vulnerabilities before attackers do, verifying that they matter and shortening the path from discovery to a safe, reviewed fix. The loop then starts again with more context and a stronger baseline.