Cursor adds Rollouts and Security bots, Google open sources phone testing tool, GLM 5.3 spotted in Cursor menu

Your daily Cursor briefing. What shipped, what changed, and what it means for the things you are building.

Edition date: 2026-09-30

Chapters:
00:00 Cursor's Rollouts bot watches code once it goes live, and Security Review scans every PR for exploits
01:23 Google open-sourced ARTEMIS, a tool that lets coding agents tap and swipe on real phones
02:24 A Cursor user reports GLM 5.3, an AI model, in Cursor's model menu

Cursor HQ · cursorhq.ai

Maya: Hey builders! Here's what's on the radar today on Cursor HQ. Cursor shipped two bots, Rollouts and Security Review, Google open-sourced ARTEMIS for driving real phones, and a user spotted GLM five point three in Cursor's menu. I'm Maya.

James: And I'm James. Let's get into it.

Maya: So Cursor put two automated bots on the last stretch of shipping. Rollouts attaches to a pull request, reads the diff, and posts a monitoring plan as a comment: the risks, the signals it will watch, any logging gaps. Engineers can edit that plan before it runs.

James: That's the sharp part, Maya. Once the change deploys, Rollouts checks it against logs, metrics, and traces, tracking staging and production separately, then returns one of three verdicts: verified healthy, regression detected, or inconclusive. It never rolls back code on its own.

Maya: Exactly right. And Security Review reads every PR against the whole codebase for exploitable bugs: injection, auth bypasses, leaked secrets, unsafe deserialization. Each finding comes with severity, the attack path, and a proposed fix. Both went live for Teams and Enterprise on September twenty-third.

James: And they handed out trial credits for ten days, roughly fifty changes for Teams accounts and five hundred for Enterprise. Both bots are opt-in per repository, enabled from the automations tab. Code style stays with Bugbot.

Maya: Now to Google, James. On September twentieth they open-sourced ARTEMIS, an MCP tool that lets a coding agent operate a real Android or iOS device like a person: it reads the screen, taps, swipes, and checks the result.

James: Right, and because it speaks MCP, it plugs into Cursor, Claude Code, Codex, and others without custom wiring, under Apache two point zero. Instead of hand-coding XCUITest or Espresso scripts, you just tell the agent what to check in plain English.

Maya: That's the workflow. Under the hood, Google says ARTEMIS locates elements by combining accessibility data, OCR, and computer vision, so a layout shift doesn't break it. Every run produces screenshots, execution traces, and diagnostics to inspect when a step fails.

James: And Google reports it completed more than ninety-nine percent of tasks on AndroidWorld across over a hundred multi-step scenarios, roughly three to five seconds per step in Flash mode. A Python SDK lets teams call it from their own pipelines.

Maya: Last one, and it's a smaller signal. A Cursor user reports in a Reddit post dated September twenty-ninth that they spotted GLM five point three in what they call the Other Models picker while checking availability.

James: Worth flagging, Maya, that the post's link is named for GLM five point three Flash too, but the text only names five point three, so we can't tell if Flash is actually in the picker. This is one user's screenshot, not a Cursor announcement.

Maya: That's your Cursor HQ daily brief. Check cursorhq.ai for the full stories. Keep building.