Bugbot Code Review Agent

11 posts · Jul 2025 – Aug 2026

What this trail covers

Bugbot has evolved into a fully agentic design, allowing it to reason over diffs, call tools, and dynamically decide where to dig deeper. This shift has enabled more aggressive prompting for deeper investigation and richer experimentation with dynamic context. The agentic architecture also allows for direct iteration on the toolset itself, significantly impacting outcomes. Bugbot now reviews over two million PRs per month and is being extended with Autofix for automatic bug fixing and the ability to guide reviews using custom knowledge about the codebase via BUGBOT.md rules.

All Cursor trails

Aug 2026Firetiger joins CursorThe Firetiger team, specializing in agents that operate on software in production, is joining Cursor. Their work focuses on monitoring rollouts, detecting regressions, investigating incidents, and feeding this information back to coding agents. This acquisition aims to bridge the gap between writing code and running it in production by enabling agents to ship changes, observe their behavior, and respond to issues. This will be integrated into Cursor's broader investment in long-running, autonomous agents for teams, including Cursor Origin and upcoming Change Monitors.
Jun 2026Bugbot is now over 3x faster, 22% cheaper, and finds 10% more bugsThis post details significant performance improvements to Bugbot, making it over 3x faster, 22% cheaper, and capable of finding 10% more bugs per review. These gains are attributed to harness improvements and progress in training Composer 2.5, which now powers Bugbot. New user-facing features include the ability to run Bugbot and Security Review with `/review` before pushing code, and a configuration option to "Only review what's new in your PR" to avoid re-reviewing previously approved code.
Apr 2026Amplitude ships 3x more production code with CursorThis post details Amplitude's adoption of Cursor's cloud agents and automations to achieve a 3x increase in production commits. It highlights the limitations of local-only agents (resource constraints, lack of full dev environment) and the benefits of cloud agents for parallelism, autonomy, and long-running tasks. Specific use cases include automating bug report triaging from Slack to PR creation, continuous legacy code refactoring via cron-based automations, and implementing Bugbot for agent-led code review with risk classification to auto-merge low-risk PRs. The post emphasizes the seamless integration between cloud and local agents within Cursor as a key enabler for product velocity.
Apr 2026Bugbot now self-improves with learned rulesThis post introduces the capability for Bugbot to self-improve by learning from live code review signals such as developer reactions (downvotes), replies, and comments from human reviewers. These signals are processed into candidate rules that are evaluated and promoted to active status or disabled based on accumulated signal. This enables Bugbot to codify learned rules, leading to a significant increase in its bug resolution rate.
Mar 2026Securing our codebase with autonomous agentsThis post details the evolution of Cursor's security tooling, moving from static analysis to autonomous agents. It introduces four new security automation templates: Agentic Security Review, Vuln Hunter, Anybump, and Invariant Sentinel. The core technical contribution lies in the 'automations architecture' which provides out-of-the-box integrations for webhooks, GitHub PRs, and codebase monitoring, powered by cloud agents. A key component is the security MCP (Master Control Program) tool, implemented as a serverless Lambda function, which enables persistent data storage for impact tracking, deduplication of LLM-generated findings using a Gemini Flash 2.5 classifier, and consistent output formatting for Slack messages and actions. Agentic Security Review evolved from Bugbot to focus specifically on security, implementing blocking gate checks. Vuln Hunter scans existing codebases for vulnerabilities. Anybump automates dependency patching by performing reachability analysis, tracing code paths, running tests, and opening PRs. Invariant Sentinel monitors engineering invariants daily, detecting drift and revalidating against previous runs.
Advertisement
Mar 2026Build agents that run automaticallyIntroduced Cursor Automations, a system for building always-on agents triggered by schedules or events (Slack, Linear, GitHub PRs, PagerDuty, webhooks). These agents run in cloud sandboxes, use MCPs and models, and have memory for learning. Specific use cases include automated security reviews on pushes to main, agentic codeowners for risk classification and reviewer assignment, and incident response agents that investigate logs and propose fixes. Chore automations include weekly summaries of changes, test coverage analysis, and bug report triage. The post also highlights external use cases at Rippling and mentions the underlying cloud agent infrastructure.
Mar 2026How technical support at Cursor uses CursorThis post details how technical support uses Cursor and its automation capabilities (MCP servers, Rules, Skills, Subagents) to integrate various data sources (codebase, logs, team knowledge, past conversations) into a unified investigation workflow, significantly increasing support engineer throughput and enabling AI-native technical support.
Mar 2026PlanetScale protects production reliability with BugbotThis post details how PlanetScale adopted Bugbot as an agentic review layer to address the bottleneck of code review in their SDLC, especially with the rise of code generation agents. It highlights Bugbot's ability to detect deeper semantic and logical issues beyond static analysis, such as state synchronization gaps, logical flow changes, asynchronous controller interactions, and edge cases. PlanetScale measures Bugbot's quality by its resolution rate, which is approximately 80% of comments addressed before merge time across over 2,000 PRs reviewed monthly. The post emphasizes that Bugbot's specialized harness and architecture are key to its effectiveness in finding critical issues that human reviewers might miss.
Feb 2026Closing the code review loop with Bugbot AutofixIntroduced Bugbot Autofix, which automatically finds and fixes issues in Pull Requests by spawning cloud agents in independent virtual machines for testing. This feature aims to improve the efficiency of code reviews by providing proposed fixes directly within PRs, with over 35% of Autofix changes being merged. The post also highlights improvements in Bugbot's overall effectiveness, with the average number of issues identified per run nearly doubling and the resolution rate increasing from 52% to 76%. Future work includes custom automations for workflows beyond code review, self-verification of findings, deep research on complex issues, and continuous codebase scanning.
Jan 2026Building a better BugbotThis post details the evolution of Bugbot from a prototype to a production system, highlighting the transition to a fully agentic design. Key contributions include the development of a "resolution rate" metric for quantitative evaluation, the implementation of a multi-pass, majority-voting approach for initial bug detection, and the integration of codebase-specific rules. The agentic architecture enabled more aggressive prompting and dynamic context utilization, leading to significant improvements in bug detection rates and a doubling of resolved bugs per PR. The post also introduces Bugbot Autofix for automatic bug fixing and future plans for code execution verification.
Dec 2025Introducing Debug Mode: Agents with runtime logsIntroduced Debug Mode, a new agent loop focused on interactive bug fixing. This mode incorporates human verification and leverages runtime information. The agent generates hypotheses, instruments code with logs to test them, collects runtime data during bug reproduction, and prompts the user to verify fixes. This process allows for precise, targeted code modifications and reliably addresses complex bugs.
Jul 2025Bugbot is out of betaBugbot is now out of beta, having reviewed over 1 million PRs and identified over 1.5 million issues during its beta period. Over 50% of identified bugs are resolved before merging. The post highlights its ability to analyze changes for logic bugs, edge cases, and security issues, and mentions the introduction of BUGBOT.md rules for custom codebase knowledge guidance. It also notes the ability to send flagged issues to Cursor or launch background agents.