Cursor

1. 01Cursor trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
2. 02Cursor is installed as a desktop app on 2 devices. If it is not approved, block it with App Control for Business or an attack surface reduction rule, and deploy the sanctioned alternative through Intune.
3. 03Device telemetry names the exact machines and accounts reaching api2.cursor.sh. Use it to target coaching rather than blanket blocks.
4. 04Cursor was seen only on endpoints, not in Entra or network discovery, so it may be used offline or from unmanaged networks. Check the device list for VPN gaps.

• ●Medium31CursorCode · GitHub (demo)0 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. endpoint_telemetry · Sep 13, 2026
   Defender for Endpoint saw Cursor on 2 devices (2 accounts) in 30 days: 2 process observations; installed on 2 devices; device connections to api2.cursor.sh
   Detail

   {
     "domains": [
       {
         "host": "api2.cursor.sh",
         "count": 2
       }
     ],
     "signals": {
       "network": 2,
       "process": 2,
       "software": 2,
       "extension": 0,
       "model_file": 0,
       "local_server": 0
     },
     "software": [
       {
         "name": "Cursor",
         "devices": 2,
         "version": "1.6.27"
       }
     ],
     "processes": [
       {
         "name": "Cursor.exe",
         "count": 2
       }
     ],
     "extensions": [],
     "deviceNames": [
       "LT-FRANK",
       "LT-LIAM"
     ]
   }