Cursor in Slack now posts a plan before executing and reads across channels.

The July 17 update makes Cursor share a plan before starting, stream status during execution, support multi-repo environments with mid-task repository switching, and read from and post to other Slack channels and threads (Cursor changelog). Cross-channel read is the real capability change and the real problem. The agent's context now spans conversations it wasn't invoked in, which means anything anyone types in any readable channel is agent input. That's a prompt injection surface with the size of your Slack workspace and no review step. Plan-before-execute is a genuine improvement though, and it's the pattern I want everywhere: make the agent commit to an approach you can reject cheaply before it commits tokens.