Cursor users report hard-to-audit coding-agent runs and hidden routing

• Cursor users are colliding with opaque agent economics: one Reddit user wanted per-run answers for model used, runtime, spend, stop reason, failures, retries, and cheaper alternatives in a Cursor pricing thread.
• Auto routing is now an explicit product surface: Cursor's Router docs say Auto Balance and Intelligence classify each request and pick the routed model, while one Reddit post complained that a new update hid the visible model choice.
• The cost model has two layers: Cursor's docs describe separate Cursor Models and Other Models pools, and one enterprise user's Luna complaint focused on the $0.25 per-million-token Cursor Token Rate hitting cached reads.
• Prompting is not the guardrail layer: a Cursor subreddit thread asked about intercepting destructive SQL before it hits a production DB URL, while Cursor's own safety docs separate deterministic controls from non-deterministic rules.
• Users are building their own operating manuals: one workflow critique used docs folders, Cursor rules, runbooks, Linear issues, Claude sanity checks, QA, and commits as one repeatable agent loop.

A community research post claims a semantic context pipeline cut API cost by up to 95.2% across 1,831 requests. Cursor's Google Workspace launch gives agents read/write access to Gmail, Drive, Calendar, Docs, and Sheets. One connector-schema complaint measured Chrome MCP at about 4.2k tokens for seven tools, loaded before the actual user request.

Cursor's Router docs say Auto Balance and Auto Intelligence run a classifier on each agent request, route by task type and complexity, and do not let users hand-pick the exact model for a request.

The same docs say Cursor manages the model pool as new models ship. They also say Balance and Intelligence are billed at the routed model's rate, while Cost uses bundled Auto pricing and generally runs cheaper.

Cursor's launch post for Router says the classifier was trained on 600k live requests and early access saved 30% to 50% on auto-routed traffic without a quality drop. The subreddit complaint landed on the other side of that abstraction: the user did not want to accidentally use Fable when Grok or Composer would do in the hidden-model thread.

The cleanest complaint was not about high prices. It was about missing accounting.

One Cursor user listed the fields they wanted for a delegated task:

• model used
• run duration
• amount spent
• stop reason
• failure mode
• wasteful retries
• whether a cheaper model would have worked

Cursor's usage-limits docs describe two monthly pools: Cursor Models for Cursor Grok 4.5 and Composer 2.5, and Other Models for third-party models charged at provider prices. Pro includes $20 of Other Models usage, Pro Plus includes $70, and Ultra includes $400.

Cursor's overages docs say Teams and Enterprise third-party model requests also include the Cursor Token Rate, including when Auto Balance or Auto Intelligence routes to a third-party model. The Luna pricing complaint argued that the flat $0.25 per-million-token surcharge becomes much larger on cached reads, where the user claimed coding workloads can be 90%+ cache cost.

A separate user asked whether the $60 Cursor plan gives separate Grok plus Composer usage and another $60 for other models, or whether the pool is combined in a usage-pools question. Developers Digest reported that Cursor shifted self-serve usage reporting to token counts on July 31, removed dollar costs from the Usage page and CSV exports, and left Enterprise dollar reporting in place.

The working pattern in the Cursor subreddit was not pure autopilot. It looked like an operating manual around the agent.

The workflow critique used:

• docs folders for features, design system, and architecture
• a Cursor rules folder with skills and runbooks, including Supabase migrations
• a loosely held PRD
• Linear for ticket context switching
• Cursor triage into Linear issues
• Cursor checking docs, rules, and git commits before proposing a plan
• a Claude sanity check before implementation
• QA and commit after the agent writes code
• stepwise debugging when the agent gets stuck
• UI border overlays with measurements for layout bugs

Cursor's Rules docs say project rules live in .cursor/rules as version-controlled .mdc files, with frontmatter controlling descriptions, globs, and alwaysApply. The same docs describe AGENTS.md as a plain-markdown alternative.

Prompt portability is still uneven. One Cursor user said the same prompt produced clean results in Cursor but needed about 3x more back-and-forth in Claude Code or Codex, then asked for patterns by tool rather than generic prompting advice.

The production-risk threads were about boundaries, not style.

One Cursor subreddit post asked whether teams changed how they run raw migrations locally after Cursor and Replit database-wipe incidents, then floated a Mac menu-bar proxy that intercepts destructive SQL before it reaches the target DB URL. Another Cursor user claimed the tool deleted nearly seven working days of development progress and asked whether paid users had a repair or restoration mechanism in a data-loss thread.

Cursor's enterprise safety docs divide controls into two categories: deterministic security controls such as terminal restrictions, hooks, approvals, and sandboxing, and non-deterministic steering mechanisms such as Rules and Commands. Cursor's run-modes docs describe Auto-review as running allowlisted calls, sandboxing shell commands when possible, and sending other calls to a classifier.

Keycard's Agent Baseline framed the same problem as six security outcomes: Discover, Constrain, Authorize, Observe, Validate, and Respond in its reference-architecture post. That is the grown-up version of the same Reddit question: what can the agent touch, under whose authority, and what evidence survives afterward.

The cost debate kept coming back to context volume.

The semantic optimization post described a four-stage pipeline:

• semantic symbol-level diffing instead of full-file transmission
• Cursor-aware context selection around active edits
• intelligent model routing by request complexity
• request deduplication and context compression

The linked GitHub writeup reports about 95.2% cost reduction in one production-style corpus, from about $162.23 per day to $7.85 per day across 1,831 requests. It frames the design target as semantic equivalence, sub-second IDE latency, and no workflow changes.

Cursor separately said cloud agents became 20% to 30% more token efficient overall and 80% more efficient on runs with computer use after improvements to MCP handling, skills, and computer use in its cloud-agent update.

Cursor's Google Workspace plugins push agent scope outside the repo. Cursor's plugin page says agents can search and read Gmail, draft and send messages, search Drive, read and create Docs, update Sheets, and manage Calendar events.

That broader scope has a context cost as well as a permission cost. One connector-schema complaint said every enabled connector schema loads into context on every turn, measured Chrome MCP at seven tools for about 4.2k tokens, and argued that Gmail, Calendar, Drive, and custom connectors can consume a real chunk of the window before the user's request is read.