Maya: Welcome to Cursor HQ. Hi, I'm Maya. Today: agents tapping through the iOS Simulator, the Agent SDK going generally available, a plugins repo, hijacked GitHub repos running hidden code, and inline comments on agent plans.

James: And I'm James. Let's get into it.

Maya: So Cursor announced Computer Use on October twenty-third, letting agents click and type in any app, not just the browser. The practical job is verification: an agent that just wrote a feature can open the running app and try it.

James: That's the real shift, Maya. In Cursor's demo the agent adds a favourite-trails feature, launches the iOS Simulator, taps the heart itself, then checks the favourites list. Reading a diff shows intent; a tap shows whether it actually works.

Maya: Exactly right, and to use it you update Cursor from cursor dot com slash download. The agent invokes Computer Use on its own, or you @-mention it. One habit Cursor suggests is ending prompts by telling the agent to demo the feature.

James: Right, and there's a cost on a Mac, Maya. The helper app needs accessibility and screen recording access, so it sees your whole screen. One walkthrough suggests running it under a separate Mac user with throwaway data.

Maya: Next, James: Cursor's Agent SDK, released October twenty-seventh, is now generally available. You describe an agent the way you'd describe any service, as files in a repo. It's the framework behind Cursor's own Bugbot, Security Reviewer and Rollouts.

James: And the layout is clean, Maya. Prompts are Markdown, tools are TypeScript functions, with connections and evals alongside. The starter calls defineAgent from the SDK with a name, a model (composer two point five), and a working directory.

Maya: The pitch is recurring work on your own rules. Cursor's example is pull request review: respond to events from GitHub, GitLab or Bitbucket, assess risk, route it, approve what meets policy. To deploy, you run agent-sdk deploy from the directory.

James: That one command builds the agent, gives it a URL, and starts it on Cursor's infrastructure, though each agent is a single Node process you can containerize yourself. The PGA Tour uses the SDK, and one internal team built kb-reviewer in about a day.

Maya: Story three, James. By default Cursor's agent sees the editor and little else. Plugins, Cursor's official repository, changes that: each plugin is a folder with a config file, the manifest, telling Cursor its name and what it offers.

James: And the set covers work outside the code, Maya. One plugin searches, reads and drafts email; a Drive plugin searches, creates and shares files; a GitHub plugin manages repos, issues, pull requests and Actions; a Playwright plugin clicks, screenshots and tests in a real browser.

Maya: There's also a calendar plugin, a Salesforce plugin for CRM records, and one that calls in a stronger model before the agent decides. Two limits though: the plugins need Cursor itself to run, and one source notes the repo lists no license, leaving reuse terms unclear.

James: Now the serious one, Maya. JFrog reported Monday that attackers broke into forty-two third-party GitHub repos and planted malicious files inflated to as much as thirteen point seven megabytes, sized to slip past GitHub search and the contents API.

Maya: And the mechanism is what gets me, James. Those files are execution hooks for Claude Code, Gemini, Cursor and VS Code, so code can run when a developer simply opens the project. For Cursor, audit dot cursor slash mcp dot json and dot cursor slash rules slash setup dot mdc.

James: JFrog says enumerate repository trees directly rather than trust code search. The way in was npm, a campaign called testmetest using binding dot gyp to run index dot js during install. Frank Dickson noted the hooks are features, not flaws; the root cause is stolen credentials.

Maya: Last one, James. Long agent plans are awkward to review in chat. The AI Artifacts extension replaces that: you ask the agent to create an artifact, and the plan opens in the editor as its own document.

James: And the workflow is tidy, Maya. Install all detected integrations from the command palette, reload, then select any paragraph or code block and type a comment. Click Review and every note goes back to the agent at once. It runs locally, no telemetry.

Maya: Exactly, and Proceed approves the plan so the agent starts work, while Just save keeps it without running anything. One limit: it runs only in local desktop editors for now, so no remote SSH, WSL, dev containers or Codespaces.

Maya: That's your Cursor HQ briefing.