Cursor's Rollouts bot tracks code from PR to production, integrating Firetiger acquisition

Cursor has introduced Rollouts, a new agent designed to follow code modifications into production environments and verify that they function as expected. The tool addresses a gap that has widened as AI coding systems have made writing code faster: the deployment and validation phase remains slow and risky.

The Firetiger acquisition sets the stage

The Rollouts announcement arrives just over a month after SpaceX completed its $60 billion acquisition of Cursor, providing the AI coding platform with access to SpaceX's GPU infrastructure for model development. Days before that deal closed, Cursor itself acquired Firetiger, a three-year-old company that had built AI agents to monitor software changes from pull request through deployment.

Rustam Lalkaka, Firetiger's co-founder and CEO, had articulated the problem the startup was solving. He observed that agentic coding had dramatically reduced the effort required to create software changes, yet deployment risks remained largely unchanged.

Over the last two years, agentic coding has changed software dramatically. The cost of creating changes has dropped to near zero. The cost and risk of deploying them has stayed largely the same.

Rustam Lalkaka, Cursor

Now at Cursor, Lalkaka has unveiled the first product from the Firetiger integration. Rollouts represents Firetiger's Change Monitors rebuilt within Cursor using a framework called Bot Development Kit, which the company has released as the @cursor/bdk package on npm. The kit allows developers to define agents using Markdown and TypeScript, with support for tools, skills, subagents, webhooks and scheduled runs.

How Rollouts operates

Rollouts begins its work when a pull request is opened. The agent examines the proposed code change, identifies which systems could be affected, and generates a monitoring plan that documents what the change should accomplish, potential risks, signals to monitor, and any instrumentation gaps. Developers can review and modify this plan before deployment.

After deployment, Rollouts evaluates telemetry data—including logs, metrics and traces—against the monitoring plan. Staging and production environments are assessed separately, with each receiving one of three outcomes: verified healthy, regression detected, or inconclusive. A change might pass staging checks but trigger a regression alert once it reaches production.

When Rollouts identifies a regression, it can pinpoint the responsible change, notify the developer, and either open a revert pull request for review or hand the issue to a Cursor cloud agent for investigation or remediation. However, humans remain in control of consequential actions: Rollouts cannot merge fixes or execute rollbacks independently, though it can pause progressive rollouts.

Lalkaka notes that Rollouts can already detect problems limited to specific endpoints or regions before they trigger broader alerts, and it can distinguish expected behavioral changes from genuine regressions. Feature flag integration is coming soon, along with support for release trains and deployment freezes.

Security Reviewer expansion

Alongside Rollouts, Cursor is unveiling an upgraded Security Reviewer bot, which entered beta in April. The bot automatically inspects pull requests for security vulnerabilities, authentication regressions, privacy and data-handling risks, agent tool auto-approvals, and prompt-injection attacks.

Security Reviewer analyzes pull requests within the context of the broader codebase, focusing on exploitable issues such as injection flaws and broken authentication. It returns a severity rating, attack path and proposed fix for each finding.

Security Review reads code the way a security engineer does. Where does user input enter, where does it end up, what does it pass through on the way.

Rustam Lalkaka, Cursor

Performance metrics show improvement: average review time has dropped 21%, from 4.8 minutes to 3.8 minutes, while developer acceptance of its findings has increased from roughly 45–50% to 60–70%.

Both Rollouts and Security Reviewer are available through Cursor's Automations tab for customers on Teams and Enterprise plans.

Integration with Origin and competitive positioning

Rollouts reveals how Cursor intends to develop Origin, its Git-compatible code hosting platform launched in August. Origin represents an attempt to build an alternative to GitHub designed for agent-heavy development workflows. While still early with limited functionality, Cursor has signaled that deeper integration with its own agents will be a primary differentiator.

When announcing the Firetiger acquisition, Cursor product team member Maxime Prades described the deal as part of a broader investment in long-running, autonomous, context-aware agents. He highlighted Origin and Change Monitors as examples of this strategy.

Agents that write code should also be able to tell whether it works in production. Today, those systems are mostly separate. Cursor and Firetiger bring them closer together so an agent can ship a change, see how it behaves, and respond when something goes wrong.

Maxime Prades, Cursor

Rollouts can connect to either Origin or GitHub for source control, pull deployment events from continuous delivery systems, and consume signals from Datadog and other telemetry providers. When it detects a regression, it can route the problem back to a Cursor cloud agent for investigation or remediation attempts.

Origin potentially provides Cursor with a native platform for more of this workflow: its cloud agents can already create branches, commit and push code, and open pull requests against Origin repositories. Rollouts adds visibility into what happens after deployment.

Cursor faces competition in this space. Zed put Delta into public beta recently with its own vision for source control in agent-heavy teams. Datadog's Bits Release, launched in preview in June, similarly follows changes from pull request into production and checks telemetry for regressions. Harness has long offered automated deployment verification and rollback based on logs and metrics, while LaunchDarkly's Guarded Rollouts can monitor feature releases for regressions and automatically reverse them.

Cursor's potential advantage lies in proximity: the coding agent, repository, pull request, security checks, and production feedback can all reside much closer together. While Rollouts does not require Origin and GitHub remains supported, owning the forge gives Cursor greater flexibility to integrate these components over time. This vertical integration may prove more compelling than simply replicating GitHub's existing capabilities.