A repository team wants unattended issue-to-pull-request work while retaining protected branches, secret controls and accountable human approval. Here is a scenario-based comparison using documentation checked on 2026-10-25, not an independently tested vendor ranking. The region, plan, exact model version and price are unspecified unless a first-party document establishes them; unmatched performance claims stay unknown.
Audience: engineering leads. Evidence checked: 2026-10-25. Editorial status: ready. Comparison scope: named scenario; region, plan and model/version parity require separate confirmation.
Different delegation surfaces create different attack surfaces
GitHub’s cloud agent is anchored to repository issues and pull requests. Cursor background agents work in remote environments that can run commands and reach the internet. Codex cloud is a further managed coding-task surface whose current eligibility and runner configuration need separate confirmation. A high task-completion figure measured for one tool on a public bug dataset cannot establish its safety inside a regulated monorepo. Compare execution permissions, not just whether agents can write a PR.
A minimal viable security pilot
Prepare a disposable repository with a failing test, a prohibited path and an obviously malicious instruction embedded in an untrusted markdown file. Do not include real secrets. Assign the same narrowly scoped issue. Observe each command, outbound access, changes to restricted files and requests for elevated permissions. The repository reviewer, not the agent, must decide whether the test failure is fixed and whether the diff remains within scope. Retain runner image, task log and manual interventions.
Pull request completion is not deployment authorization
An agent may write code and open a pull request; it should not bypass branch protection, code-owner reviews, dependency scanning or change management. For migrations, require a rollback plan and regression fixtures. Cursor’s own description warns that automatically executed commands and internet access create exfiltration risks. Cloud execution also requires clarity about temporary copies of source code and secrets, even when the local editor has privacy settings.
Choose by constraints, then throughput
Use GitHub-centered delegation when issue/PR governance is primary. Consider a more interactive remote development environment when the human needs to take over and inspect a runner. Consider Codex cloud when its task and policy model aligns with internal controls. Compare accepted, deployable patches per reviewer hour on the same codebase; seat prices, task billing and quotas must come from dated AI 10 records.
What an actual buyer pilot should measure
Freeze the relevant source files, release identifiers, evaluation prompts, operator permissions and reviewer identities. Use the same rights-cleared materials for every candidate; separate tasks that cannot be configured equivalently instead of forcing them into a single ranking. Review the resulting artifacts against objective acceptance criteria specific to this decision: source traceability, error handling, rework, permission boundaries and whether a competent human approves the final deliverable. Record rejected attempts as well as successful examples. This is a proposed method, not a claim that these vendors have been tested by this publication.
Costs and unresolved evidence
Do not equate an interactive assistant seat, media credit, billable character, hosted token or self-hosted GPU hour. To estimate actual spending, count accepted results, failed attempts, revision cycles, human review, security operations and export/storage costs. AI 10 must supply dated provider-specific pricing records with tier, unit, currency and region; in their absence, monetary figures and claims of price parity remain unknown. Account-level availability and contract addenda require verification. No universal winner score or fictitious hands-on rating is assigned.
Decision for this scenario
Demand a human-reviewed pull request, sandbox audit and secret-safe dry run before any unattended agent receives repository write access.
The article has documented feature and policy evidence but no independent hands-on performance test. Reconfirm plan, region and terms before publication; editorial ready is not WordPress publication approval.
Sources and Further Reading
Original provider and policy sources are listed here. Source-to-claim identifiers are maintained separately in the editorial CSV rather than inserting numbered references into the main text. Where documents are mutable, the access date describes the verification point only.
- GitHub — Using Copilot cloud agent on GitHub (checked 2026-10-25)
- Cursor — Background Agents (checked 2026-10-25)
- OpenAI — Using Codex Cloud (checked 2026-10-25)