Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Cursor Keep an Audit Log of What the Agent Did?
No: Cursor's agent security page sets approvals for terminal commands and MCP connections, calls its run modes "best-effort guardrails rather than a hard security boundary," and describes no audit log of what the agent ran or read. Ask for a per-session record exported to your own monitoring, and test what it contains.
An agent session ends and the work looks finished: the pull request is open, the config change merged, the invoice paid. Six weeks later a SOC 2 auditor asks which session touched the payments service, and the team has a chat window, a diff and a developer's memory. That request is what this question turns on.
Cursor's agent security page makes approval the default: "By default, terminal commands need your approval" and "All MCP connections need your approval" (Cursor, 2026). It also warns that "AI can behave unexpectedly due to prompt injection, hallucinations, and other issues" (Cursor, 2026). What the page does not describe is an audit log: a per-session record of the commands run, the files read and the values the model saw, exportable to the team's own monitoring. The session transcript is what remains, and a transcript is a conversation, not a queryable log.
Pew's survey, reported by MIT Technology Review, found that "more adults in the US think AI will have a negative impact on them personally, and on society in general" (MIT Technology Review, 2026), and a team that cannot show what its agent did has no answer.
The example is one record type: the evidence a SOC 2 auditor requests about a session that touched a payments service.
Key findings
- For an agent's work to be auditable at the screen, the values on that page would have to be replaced with consistent tokens before the model receives them, so the record can show what the model saw without the real data (What Is Render-Layer Tokenization?).
- It would also require a named person approving each command, payment and record change, and every screen and approval written to a record exported to the organization's monitoring (What Is an AI Control Record?).
- Cursor's agent security page describes no audit log of the commands run or the files read, and leaves the session as the record (Cursor, 2026).
- The page states that "By default, terminal commands need your approval" and that "All MCP connections need your approval," so the unit it gates is an action, not the values a model read before it (Cursor, 2026).
- Microsoft's Purview page lists what a record can carry: "References to all resources (files, documents, emails, etc.) which Copilot accessed in response to the user's request," a resource list rather than a record of what a screen rendered (Microsoft, Audit logs, 2026).
- The 2025 AI Agent Index found that "most developers share little information about safety, evaluations, and societal impacts," the documentation gap a buyer meets when asking for an audit log (Staufer et al., 2026).
What does Cursor record while its agent runs?
An audit record is only as useful as the layer it covers. A governed browser environment covers what the agent reads and does once a page renders: dashboards, consoles, settings pages and sign-up forms. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP, and a coding agent works mostly in that second list. Across the 86 AI security products reviewed, 36 describe a record of what the model was shown, and every one is a prompt, conversation or request payload at the product's own gateway; none describes recording the rendered screen an agent read (How Many AI Security Products Control What an AI Agent Sees?).
Cursor's agent security page sets its controls at the layer it covers. It makes approval the default for terminal commands and MCP connections, and warns that the model can behave unexpectedly through prompt injection and hallucination (Cursor, 2026). The session shows the requests, the tool calls, the terminal output and the diff: a record the way a notebook is one, readable by the person who did the work, hard to search by session, time, file or value, and silent on what the model read when a page rendered.
The page describes approvals and guardrails, not a log: there is no export of the session to the team's monitoring and no statement of what the model received (Cursor, 2026). How Do You Audit What an AI Agent Saw and Did? sets out why a log of what a model read becomes a second repository of sensitive records. How to Maintain Audit Trails for AI Agent Activity covers the retention settings that make a record usable months later, and the Cursor page states none.
How would a SOC 2 auditor reconstruct a session from the chat history?
The auditor's request is narrow: which agent session touched the payments service, what it changed, and who approved the change. Reconstructing that from Cursor today takes four steps: find the session by its title or the deployment date, match the terminal output to the deployment record, read the diff for the service's configuration, and ask the developer what the screen showed. Which SOC 2 Controls Apply to AI Agents? explains why the request lands inside the controls being evaluated.
AWS's guidance states the requirement plainly: "audit logs attribute every action unambiguously to either an agent or a human actor" (AWS, 2026). A session history meets the second half and strains the first. The transcript says what ran, which files changed and who was at the keyboard, and leaves the reader to infer the agent's part from the tool calls. The reconstruction depends on an interview as much as on the file.
| What the session leaves | What it answers | What it leaves open |
|---|---|---|
| The transcript | What the developer asked and which tools were called | Which values the model read on a rendered page |
| The terminal output | Which commands ran and what they printed | Which account, token or environment the command used |
| The diff | Which files changed | Which files were read and not changed |
| The approval prompt | That a person allowed a command | What that person saw before answering |
What do the vendors themselves say?
Two vendor pages bear on the request, and they answer different halves of it. Cursor documents where its controls sit. Microsoft documents what an audit record of agent work contains.
Cursor sets the approval at the command and at the connection, which is the right unit for a destructive command and the wrong unit for a value the model has already read (Cursor, 2026). A person who approves a command has approved an action; the page says nothing about the values the command will read once it runs, and which record the session leaves is not described in the pages reviewed beyond the transcript.
Microsoft's Copilot Studio page states that data policies control agent knowledge sources, actions, connectors and skills, and that admins have full visibility into maker audit logs in Purview (Microsoft, Security and governance, 2026). That record belongs to a maker's actions in a studio, not a developer's session in an editor, and it is the kind of statement a buyer can ask a coding tool to match.
Read together, the two pages set the test. A vendor that documents the actions it gates and the record those actions leave has answered the first half of the auditor's request. The second half, what the model read when a screen rendered, needs a page that says so, and the Cursor pages reviewed stop at the session.
Which parts of the work does the record have to cover?
A coding agent's work crosses three layers, and a record that covers one looks complete until an auditor asks about another. The command layer is the terminal: what ran, with which arguments and under which account. The file layer is the tree: which files were read, edited or left alone. The page layer is the browser: which page the agent opened, and what values the model received.
A study drew on "98,380 skills collected from two major registries" and identified 157 skills exhibiting confirmed malicious behavior (USENIX Association, 2026). Those skills "execute with full user privileges," so a log that names the command but not the skill misses what it could reach.
The PCI Security Standards Council's FAQ says its SAQ A criterion "only applies to e-commerce merchants with a webpage that includes a TPSP's/payment processor's embedded payment page/form" and "does not apply to e-commerce merchants with a webpage that redirects customers from the merchant's webpage to a TPSP/payment processor" (PCI Security Standards Council, 2025). The criterion turns on which page a browser loaded, so a record of the page is the evidence.
How Do I Know Which Credentials a Coding Agent Has Touched? covers the command layer and Does Cursor Read My .env File? the file layer.
What should a security team ask for in writing?
The ask is a short list: a per-session export in a format the team's SIEM can read, not a screenshot of a chat; the agent's own identity, so an action attributes to the agent rather than to the developer; what the model received from a rendered screen, captured at the page rather than reconstructed from the diff; the name of the person who approved each consequential action; and a retention window the team sets, with a statement of where the record is stored. Ask for one sample record from a completed session, so the format is tested rather than promised.
The approval item deserves its own sentence. Automation bias, "the tendency to over-rely on automation," has been studied in various academic fields, which is why a record has to show what the approver saw and not only that a prompt was answered (Goddard et al., 2012). An approval with no captured screen is a click, and a click is what an auditor will discount first.
Ask for a pilot on one workflow. Pick one completed session, ask the vendor to reproduce the record it would have kept, and compare that record to the transcript and the diff. What Is Supervised Delegation? sets out what the named approver has to be able to answer for, and the record either carries that name or it does not.
What does a governed environment change?
A governed environment changes what a record can show, because it decides what reaches the model before the model acts. On a rendered page, the values a policy selects are replaced with consistent tokens for the whole run, so a payments dashboard shows ACCT_001 and SIGNING_KEY_001 rather than the merchant's account number and signing key. Real values resolve only at the approved destination, at the moment of an approved action. A named person approves each payment, submission and record change, and every screen and approval is written to a record that exports to the organization's monitoring.
For the auditor's request, that changes two answers. The record can state what the model read on the page, field by field, because the page was drawn with tokens rather than live data. And it can state who approved the action, because the approval is a step in the run rather than a prompt answered in a chat window.
The scope is the rendered page. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP, where the harness and the operating system keep the record. Read beside the session history above, it supplies the page layer and names the layer each remaining question belongs to.
The side-by-side for this page's vendor is in RedactSure vs Cursor: 2026 Comparison & Alternative.
What the record shows
A record of an agent's work is useful when it names the session, the values the model read and the person who approved each consequential action, and when it can be queried by session and resource. A chat history gives the first and part of the third; the second is a prompt answered by a person whose screen was not captured. For the auditor's request, that leaves the exposure question open: the transcript shows the change, not the values the model saw. An engineering lead should test the team's own history in an hour by taking one completed session, listing the service it touched and the values that would have appeared on the screen, then comparing that list with the transcript and the diff.
Methodology and limitations
The page rests on Cursor's agent security page, Microsoft's Copilot Studio and Purview pages, AWS's guidance, a review of automation bias, a USENIX paper on agent skills, an index of deployed agents, a press survey, and a PCI FAQ, with existing RedactSure research pages. Vendor pages were read between October 20, 2026 and October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested hands-on. "Not described in the pages reviewed" means the pages reviewed for this page, not a statement about what a product does; vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. The payments service is a record type, not an organization. Determinations belong to counsel, assessors and the organization's security and compliance officers.
Frequently asked questions
Does Cursor keep an audit log of what its agent did?
No, not from the pages reviewed. Cursor's agent security page documents approvals for terminal commands and MCP connections, and calls its run modes "best-effort guardrails rather than a hard security boundary." It describes no exported record of the commands run, the files read or the values the model saw, so the transcript is what a team can produce. Ask the vendor for a per-session export before you rely on the history as evidence.
What record does a Cursor agent session actually leave?
A conversation and its side effects: the developer's requests, the tool calls, the terminal output and the diff of the files that changed. The developer who ran it can read it later, and a colleague can search for a session by name or date. What it does not carry is a field for the values the model read on a rendered page, or an export a compliance team can take custody of. Treat it as a notebook, not a ledger.
Can a SOC 2 auditor accept the chat history as evidence?
Only as a reconstruction. The history shows activity, which supports the question of what changed, and it leaves the exposure question to an interview: which screen the agent saw, which values were on it, and who approved the action. An auditor can work with that account, and it is weaker than a record produced during the run. The difference matters most where the service handles payments or account data.
Who approves an agent's action in Cursor, and what does that approval cover?
A person at the prompt, or a run mode the vendor describes as a guardrail rather than a boundary. The approval covers the command about to run, which is the right unit for a destructive action and the wrong one for data the model has already read. It records that a person allowed the command, not what that person could see when they decided.
What should a record show about what the model read?
The values it received, field by field, at the moment the page rendered. A governed environment can show that because it draws the page with consistent tokens in place of the values a policy selects, then resolves the real value only at an approved destination. A chat history cannot show it, because the page was drawn by the application before the agent ever spoke. Ask a vendor to reproduce the screen the model saw.
What would make an agent record sufficient for an auditor?
A named session, the identity of the agent as distinct from the developer, the commands and file reads it performed, the values it was shown on each rendered page, the name of the person who approved each consequential action, and a retention window set by the organization. The record should export to the team's own monitoring, so custody does not rest with the vendor. Each of those can be checked against one completed session.
How RedactSure Turns an Agent Session Into an Auditable Record
A chat transcript records what a developer and an agent said, and never shows which values the model read or who approved the action. A registry study found 157 skills exhibiting confirmed malicious behavior among 98,380 collected (USENIX Association, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the payments dashboard under the developer's session, and the merchant's account number and signing key render into its context. Inside: the dashboard shows ACCT_001 and SIGNING_KEY_001, a named person approves the key rotation, and the real values reach the provider's form only at that action.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An auditor will ask about one session, and its record either shows what the model read or does not. Bring that session and see, with test values, the dashboard as the model receives it, the approval and the record. Book a demo