For years, application security has rested on one assumption: a human reviews code before it gets merged.
The rest of the coding workflow follows from this assumption. A developer writes code, commits it, pushes a branch, and opens a pull request. Security tooling runs at the PR stage, a human reviewer sees what it flags, and anything risky gets fixed before merge.
However, the shift towards autonomous coding agents moves the security checkpoint out of reach. Cloud agents write code, commit it, and push it from environments that security teams do not fully control. One of our customers saw 93 pull requests opened by Cursor cloud agents in a single month. Another routes roughly a quarter of its active development through cloud agents. A third runs Cursor, Codex, and Claude Code in parallel sandboxes.
For workflows that involve autonomous cloud agents generating hundreds of lines of code every minute, a vulnerability flagged at PR review arrives too late. By the time a vulnerability shows up in review, the code has already left the environment where it was generated, and the coding agent has moved on to a different task. To best secure agent-generated code, we must move the checkpoint upstream, to the moment before code leaves the agent at all.
Today we are making pre-commit security scanning for Cursor cloud agents generally available in Corridor. With our pre-commit security scans, Corridor scans staged changes at commit time, blocks vulnerable commits before they leave the agent's environment, and returns findings inline so the agent can fix the issue and retry in the same session.
How it works
When a cloud agent stages a diff and runs git commit, Corridor scans the staged changes before Git creates the commit.
If nothing is flagged, the commit proceeds normally. If Corridor finds a vulnerability, the commit is blocked and the findings go straight back to the agent, which can fix the issue and retry the commit in the same agent session.
What we found running pre-commit scans ourselves
We have been scanning our own code at commit time for weeks. In this window, Corridor surfaced more than 400 issues before any of them reached a pull request. This enabled us to remediate vulnerabilities while there was still an opportunity for the agent to fix them, rather than propagating them downstream as review work.
Toward one security layer for agent-generated code
Pre-commit scanning for cloud agents is just one piece of a larger shift. As organizations adopt autonomous agents, security teams are being asked to secure code generated across many environments: local agents, cloud agents, agentic CI pipelines, isolated sandboxes, and review agents.
Corridor's goal is to provide a single security layer for agent-generated code, catching vulnerabilities early, returning findings to the system that generated the code, and giving security teams a clear view of how agent-driven development is reshaping their risk over time.
Security spent the last decade optimizing review after code is written. As development moves toward autonomous generation, security has to move upstream with it. Pre-commit scanning is a first step, and it is now available with Corridor!
Read the docs to get started with Corridor pre-commit scanning today!