Travis McPeak, security lead at Cursor, joined us at Black Hat to talk about what causes coding agents to become problematic and what he's done to keep them on track.

What he sees most is the main agent trying hard to solve your problem, getting stuck, and then getting creative. He calls it thrash, and most of the time when somebody says an agent deleted their database, that is what happened.

This episode gets into why static controls like block lists and WAFs break down against an agent whose whole job is to find a way through, why an agent can't monitor itself, and how Cursor's auto review agent works: every tool call the main agent is about to make goes to a separate reviewer that does not care about the main goal at all and only enforces its rules.

Travis also explains why the team had to carefully word the feedback so the main agent would not spiral, why blocking an action can cause the exact thrash you were trying to prevent, and why least privilege finally scales now thanks to new solutions.