On this page · 11 sections
Summary. Cursor Automations, shipped in March 2026 and expanded with new triggers in June 2026, let you run cloud coding agents automatically: on a schedule, or in response to a Slack message, a merged GitHub pull request, a new Linear issue, a PagerDuty incident, or a webhook. Each run spins up a cloud sandbox, follows your written instructions with the models and MCP servers you have configured, and can open a pull request when it finishes. Cursor runs up to 8 cloud agents in parallel. Automations are available on the Pro plan at $20 a month and the Ultra plan at $200 a month as of July 2026. The shift is from prompt-and-watch to set-and-forget: agents that trigger themselves and hand back finished work. This guide shows how to wire them up, six workflows that earn their keep, what they cost, and the guardrails that keep an always-on agent from doing damage.
The wider context is that Cursor, built by Anysphere, is betting hard on autonomous agents; SpaceX agreed to acquire the company at a $60 billion valuation on June 16, 2026. Automations are the productised version of that bet, and they are useful today whether or not you care about the roadmap.
What Cursor Automations actually are
An Automation is a saved cloud agent with a trigger, an instruction set, and an output. When the trigger fires, Cursor starts a cloud agent in a sandbox, clones your repository, and lets the agent work using the models and MCP servers you configured. When it is done, it can post to Slack, open a pull request, comment on an issue, or call a webhook. The agent also has a memory tool, so it can learn from past runs and improve on repeated tasks rather than starting cold each time.
This is different from the inline assistant most people know. The inline agent waits for you to prompt it. An Automation fires on an event or a clock, runs in the cloud without tying up your machine, and reports back. Michael Truell, CEO of Cursor, has framed the goal directly: "We need to get to a world where working with agents is really like working with a colleague, and you can treat it just like you have your own team of engineers." Automations are the first place that framing becomes concrete, because the agent starts work without you being in the loop.
The triggers
The trigger is the design decision that matters most. Cursor supports scheduled runs and event triggers from the tools most teams already live in.
| Trigger | Source | Example |
|---|---|---|
| Schedule or timer | Cron-style clock | A nightly dependency-update agent that opens a PR each morning |
| Slack reaction | Slack | React to a message with a set emoji to launch an agent on that request |
| Pull request merged | GitHub | Kick off a post-merge changelog or docs update |
| Issue created | Linear | Draft an implementation plan or first patch for a new ticket |
| Incident opened | PagerDuty | Investigate logs and post a proposed fix to the on-call channel |
| Webhook | Any service | Trigger from CI, a form, or an internal tool that can POST |
The Slack path is the one teams adopt fastest, because it needs no new interface. You react to any message with a designated emoji and the automation picks up that message as its task. The event triggers from GitHub, Linear, and PagerDuty are what turn Automations from a convenience into part of the delivery pipeline.
How to set one up
The setup is the same shape for every automation, so learn it once.
- Pick the trigger. Start with a schedule while you test, then switch to an event trigger such as a merged GitHub PR or a Slack emoji once the behaviour is right.
- Write the instructions. Treat this like a runbook for a junior engineer: state the goal, the constraints, which files or directories to touch, and what "done" looks like. Vague instructions are where autonomous agents go wrong.
- Choose the model and MCP servers. The agent uses the model you set and any MCP servers you have connected, so give it exactly the tools the task needs and nothing more. If you build custom tools, our note on MCP server development and integration covers wiring them safely.
- Define the output. Decide whether the agent opens a pull request, posts to a Slack channel, comments on the issue, or calls a webhook. For anything that changes code, prefer a pull request so a human reviews before merge.
- Test on a low-stakes repository first. Run it manually a few times, read the diffs, and only then attach the live trigger.
The rule that keeps this safe is simple: an automation should propose, and a human should dispose, for anything that ships. Let the agent open the PR; keep the merge button with a person.
Six workflows that earn their keep
These are the automations that repay the setup cost for most engineering teams.
First, security review on every pull request. Trigger on a PR, have the agent audit the diff for injection, secrets, and unsafe calls, and post high-risk findings to a Slack channel. Pair it with real hardening; agents that run shell commands are themselves an attack surface, which we cover in hardening AI coding agents against shell injection.
Second, incident response triage. Trigger on a PagerDuty incident, let the agent read recent logs and the relevant code, and post a first hypothesis plus a proposed fix to the on-call channel so the human starts from a lead, not a blank page.
Third, scheduled dependency and CI hygiene. A nightly timer agent updates dependencies, runs the test suite, and opens a PR only when tests pass. Silent test failures are the risk here; our piece on AI agent evals and silent CI/CD failures explains how to catch them.
Fourth, post-merge documentation sync. Trigger on a merged PR to update the changelog, API docs, or README so documentation stops drifting from the code.
Fifth, issue-to-plan drafting. Trigger on a new Linear issue and have the agent produce an implementation plan or a first-pass patch as a draft PR, which a developer then takes over.
Sixth, the weekly summary. A Friday timer agent rounds up merged work, open risks, and stale PRs and posts a digest to the team channel.
What it costs
Automations ride on Cursor's paid plans, and cost is driven by agent usage, not a per-automation fee.
| Plan (July 2026) | Price | What you get |
|---|---|---|
| Pro | $20 per month | Automations with a limited pool of agent usage; fine for individuals and small teams |
| Premium | $120 per month ($96 on annual billing) | Roughly five times the standard included usage for heavier teams |
| Ultra | $200 per month | Automations with most usage caps removed, for teams running agents continuously |
The number that surprises teams is not the plan price but the compute the agents consume once several automations run on every push. Meter it early. If you run Cursor across a team, the seat-and-usage mix is its own decision, which we break down in our note on the Cursor Teams premium and standard seat mix. Budget for agent minutes the way you budget for CI minutes, because that is what they are.
Guardrails and limits
An always-on agent that can edit code and call tools needs boundaries. Five hold up in practice.
Keep humans on the merge. Automations should open pull requests, not push to main. The review gate is your safety net against a confident but wrong change.
Scope the tools. Give each automation only the MCP servers and repository access it needs. A docs-sync agent has no reason to hold production credentials.
Watch the blast radius of self-triggering. An automation that posts to Slack, which then triggers another automation, can loop. Add guards so an agent does not trigger itself in a cycle.
Treat the agent as an attack surface. A cloud agent that runs commands from a repo can be steered by malicious content in that repo or an issue. Isolate the sandbox, and review what the agent is allowed to execute; our secure AI-assisted development practice is built around exactly this risk.
Verify the work, do not trust it. Agents produce confident output that is sometimes wrong. Gate every code-changing automation behind tests and human review before merge, and measure how often its suggestions actually hold up before you widen its scope.
India and team considerations
For teams in India and other DPDP-facing markets, one detail deserves attention: a cloud agent clones your repository and runs in Cursor's cloud, so any personal data in code, fixtures, or logs leaves your environment. Under the Digital Personal Data Protection Act, 2023, that processing has to be accounted for. Keep production personal data out of repositories the agent can reach, scrub test fixtures, and record the cloud-agent processing in your data map. For distributed Indian teams, the Slack-triggered workflow is the easiest on-ramp, because it meets developers where they already coordinate and needs no new tool to learn.
Common mistakes
The three failures we see most: giving an automation vague instructions and being surprised when it does the wrong thing, letting an agent push directly to main instead of opening a reviewable PR, and ignoring agent-compute cost until the bill arrives. All three are avoidable. Write instructions like a runbook, keep a human on the merge, and meter usage from day one. Automations are a force multiplier when scoped tightly and a liability when handed the keys.
FAQ
How eCorpIT can help
eCorpIT is a senior-led engineering organisation in Gurugram that helps teams adopt AI coding agents without the usual foot-guns. We set up Cursor Automations with tight instructions and scoped tools, wire triggers into your GitHub, Slack, and CI, build the MCP servers your agents need, and put the review gates and security hardening around them so automation speeds delivery without shipping risk. If you want event-triggered agents working for your team in 2026, talk to our team and we will design the workflow with you.
References
_Last updated: July 19, 2026._
