Cloud coding changes the trust boundary even when an engineer starts the request inside a familiar editor. Cursor Cloud Agents execute in Cursor-managed virtual machines rather than directly on a laptop, and their ability to clone code, hold configured secrets, reach the network and create a draft pull request deserves a separate security review from ordinary in-editor completion.
What the tool actually does
Cursor describes a sequence of provisioning a per-agent VM, cloning an authorized repository, installing dependencies, executing tools, persisting session material and opening a draft pull request. Organization administrators install a GitHub or GitLab app over selected repositories; a user also connects an account, and access is bounded by the repositories that user already can access. A VM boundary helps isolate concurrent tasks but does not mean prompts, logs and artifacts cease to exist.
A practical workflow and what to verify
For a low-risk proof of concept, choose a repository with synthetic data and a reproducible failing test. Authorize only that repository in the Git provider, configure a task that produces a test and a one-file fix, and verify which integrations can start the job. Inspect the generated branch, draft pull request, task log, dependency changes, outbound network destinations and any secret-scoped configuration. Have a second engineer rerun the test on an independent checkout before approving a merge.
Limits and failure modes
A cloud VM may need network access to fetch dependencies and may persist conversational state or artifacts after execution. Third-party package scripts, hostile issue comments and manipulated test output are potential prompt-injection and execution risks. Do not equate dedicated VMs with a guarantee against credential misuse, malicious dependencies or vulnerable patches. The availability of enterprise controls, network restrictions and retention behavior must be confirmed for the actual plan and account.
Data governance, approvals and security
Use GitHub or GitLab app repository scope, user authorization, protected branch rules and confidential credential brokering as distinct controls. Never give a test agent a production deployment key merely to avoid configuration work. For incident response, document where the session transcript and build artifacts can be accessed, who may revoke the app, and how to disable future launches. Cursor publishes separate security, secrets/network and data-use documentation; treat vendor guarantees as vendor statements, not independent audit results.
Who should use it—and alternatives
Consider this route when a team wants asynchronous repository changes that enter normal pull-request review. A locally gated Cursor IDE session, Claude Code or Codex CLI can offer a different data boundary; GitHub Copilot cloud agent is another delegated-PR option. Choose according to data governance and review capability, not by assuming cloud execution is automatically more capable than editor assistance.
Documented scope and evidence date
This article reports the development workflow documented in the linked first-party sources accessed on 25 October 2026. It is not a hands-on product test or an independent performance claim. Client behavior, account entitlements and supported countries can differ across releases. Exact per-seat charges, quotas, trial allowances, API-model versions, and deployment guarantees are intentionally not supplied without a dated, tier-specific verification. For engineering procurement, capture the installed client version and active contract as separate evidence.
Acceptance checklist before production
- Check the exact editor, extension or CLI version in the actual installation, and the applicable sign-in or admin policy.
- Give the task a clear behavioral acceptance criterion and specify files, branches, credentials and networks outside its permitted scope.
- Use a disposable branch/worktree and preserve the baseline; do not rely on an agent summary as proof of test execution.
- Review the diff, new packages, build scripts and CI configuration, then rerun targeted and regression tests in a trusted environment.
- Require normal peer review and release approvals; keep a record of external code/context processors before using confidential repositories.
Sources & Further Reading
- https://prod.cursor.com/docs/cloud-agent/security (official publisher documentation; accessed 25 October 2026)
- https://prod.cursor.com/docs/cloud-agent/security-network (official publisher documentation; accessed 25 October 2026)
- https://cursor.com/data-use (official publisher documentation; accessed 25 October 2026)