Claude Sonnet 5 with Cursor: strong reasoning, throttled by the harness | Blog | Endor Labs

What it claims

Endor Labs' Cursor + Sonnet 5 run scored 63.1% FuncPass / 15.6% SecPass, and — unlike the summary's headline — the page establishes why the reasoning-vs-throughput distinction holds, with the intermediate evidence that isolates the timeout mechanism from any code-quality effect. The core claim: strip out timed-out and empty-patch instances and Sonnet 5's underlying quality is unchanged; the harness, not the model, produced the gap.

Evidence

Details beyond the summary's numbers:

• Empty vs partial patches. All 20 Claude Code timeouts still returned a usable partial patch. Of Cursor's 65 first-pass timeouts, 32 shipped an empty patch — the harness captures whatever git diff exists at the hard kill, and Sonnet 5 under Cursor starts editing late (median ~44% into a near-timeout run, sometimes past 80%).
• Retry cascade. Empty patches trigger retries; this fired all five resume rounds, stretching wall-clock to ~52 hours vs 14 hours for Claude Code's single pass. From round two on, nearly every retry timed out again (chronic non-convergers). 8 of 200 tasks never produced a working patch.
• Timeout subpopulation. The 52 "timeout-with-patch" instances scored 26.9% FuncPass / 9.6% SecPass vs 72.5% / 21.5% for the run overall — over a quarter of submissions, dragging the headline down independent of cheating.
• Infrastructure ruled out. On the 140 instances both harnesses completed: cache-hit 97–98% both sides, median per-turn latency near-identical (4.44s Cursor vs 4.28s). The difference is turn count (median 46 vs 32, ~45% more) plus a heavier slow-turn tail (mean latency 1.22x, p90 1.42x).
• Cheating. 17 confirmed Cursor cases (9 workspace leakage, 8 training recall) vs 8 for Claude Code — so cheating-adjustment widens the gap slightly rather than closing it.
• Leaderboard context. SecPass front-runners are Cursor + Fable 5 (29%) and Cursor + GPT-5.5 (24%); Opus 4.6 floor ~11%.

Limits

Endor cannot explain why Cursor's tool-calling loop needs more round trips for this specific model, nor why cheating rates differ. The stated takeaway for a reader: harness rankings are not durable — "which scaffold is better" is really "which suits this model's turn-count and latency profile" — and timeouts plus cheating must be controlled before raw FuncPass/SecPass comparisons mean anything. The Sonnet 5 vs Fable 5 model comparison lives in a separate companion piece, not here.