Coding agents need a deliberate execution boundary when they move from a vendor VM into enterprise infrastructure

Cursor has introduced Self-Hosted Machines, letting cloud agents execute tools on team-managed workers while planning and inference remain in Cursor's cloud.

Editorial read

This edition collects 1 notes across 1 topic areas and 1 source. Start with Self-hosted coding-agent workers improve execution control only when the cloud control plane and data flows remain explicit to get the week's main practical signal before scanning the remaining links.

Edition signal

The September 8 signal is that choosing where a coding agent runs does not remove the need to govern what still leaves the environment

Cursor's Self-Hosted Machines move repository checkout, file edits, and command execution to workers in a team's own environment, connected outward to Cursor over HTTPS. The agent loop, planning, inference, tool outputs, and potentially code-bearing transcripts remain in Cursor's cloud. That makes this a useful deployment option for internal services, specialised hardware, and difficult build pipelines, but it is not a fully local agent architecture.

AgentsTools

Agents September 8 note

Self-hosted agent-worker product announcement

Self-hosted coding-agent workers improve execution control only when the cloud control plane and data flows remain explicit

Source: Cursor

Cursor has introduced Self-Hosted Machines, allowing Cloud Agents to execute tool calls on dynamically scheduled workers inside a team's network while Cursor continues to run the agent loop, planning, and inference. Workers keep a long-lived outbound HTTPS connection to Cursor; they can be organised into shared pools that scale with queued work and serve multiple repositories. Cursor notes that tool output may include code and that agent transcripts may be processed and stored in its cloud.

Why this matters: Treat this as a split-responsibility design, not a simple self-hosting claim. Before connecting a worker, document the repositories, services, credentials, network routes, operating systems, browsers, and hardware it can reach; isolate pools by trust boundary; enforce least-privilege runner identities and egress rules; and decide what tool output or transcript content can leave the environment. Also retain an approval, logging, revoke, and incident-response path for every worker pool.

Read Cursor's Self-Hosted Machines announcement