Security teams blocked Cursor, so agents move on-prem

With SpaceXAI as its launch partner, Coder announced Coder Agent Relay, a service that splits Cursor’s cloud agents in two. The tools the agents call and the code they work on stay on servers the customer runs. Cursor keeps inference and planning in its own cloud. The service is aimed at banks, life sciences companies, defense and aerospace contractors and government teams whose security departments have kept AI coding agents out.

The first product is Coder Agent Relay for Cursor. CEO Rob Whiteley described it to The New Stack in a September 4 piece. Cursor itself became part of SpaceX when that acquisition closed on August 14. The $60 billion all-stock deal put Cursor inside the SpaceXAI division as a wholly owned subsidiary, next to Grok and X.

How the relay splits the work

Each Coder workspace can start a Cursor worker, which opens an outbound connection to Cursor. Cursor keeps running the agent loop, including inference and planning. The actions happen in Coder. Tool calls execute in Coder environments on the customer’s network, so source code, secrets and internal services stay on machines the customer controls. Tool execution and the repository checkout remain on customer-controlled infrastructure.

But the split is about where code runs. What the model sees still crosses the line: relevant code and tool output are sent to Cursor for cloud-hosted reasoning, and model selection and inference stay with the cloud provider. That makes Cursor’s model lineup part of what a regulated buyer signs up for, and the lineup is changing. Late in August, OpenAI began winding down its model supply contract with Cursor, telling SpaceX on August 28.

The developer keeps the Cursor interface they already use. Platform teams provision and scale the agent workspaces the same way they already manage developer environments in Coder, so Cloud Agents can run at scale next to private code and custom hardware.

Sandboxed, ephemeral, one task each

Each agent environment is sandboxed, ephemeral and scoped to a single task. Policies on the workspace restrict which destinations it can reach. If a prompt injection, an instruction hidden in content the agent reads, tries to push the agent toward an unauthorized resource, the environment layer blocks it instead of leaving the model to refuse. The New Stack added its own caveat that the policy enforcement works “in theory, if not also in practice.”

Every run produces a log of what the agent accessed, executed and changed, and what it was blocked from doing. Compliance reporting for any time window need not be rebuilt by hand. That covers the requirements Coder says vendor-hosted tools can’t meet in regulated organizations: controlled access to source code, secured and governed execution environments, and an audit trail for every action.

Why security teams said no

Whiteley argues that agents themselves were never the problem for these customers. The deployment model was, and it often led to an outright ban.

“The worst-case is the common case: blocking Cursor outright,” he said. “We have dozens of customers where the security team did so. Not because anything is wrong or insecure with Cursor. It’s just an architectural mismatch. These enterprises need complete control over the environment in which an agent runs.”

He described a typical sequence. A team adopts Cursor and sees productivity rise. As adoption grows, the security team notices and pulls it back entirely. According to Whiteley, some of those customers have since reversed course with a mandate that reads: “You can use Cursor, you just need to run the agents in Coder.” The alternative developers were sometimes offered was worse, he said: being “told they need to use Citrix.”

Whiteley said the two companies “independently arrived” at the need for a tighter integration, and that customers had asked for it. “The customer should never be the systems integrator – and to be honest, many customers were already doing this. Cursor has supported self-hosted agents since March,” he said. The product integration comes with a joint go-to-market effort between the two companies.

The 1% problem

Whiteley pointed to his own company’s usage. “At Coder, 1% of my engineers are responsible for 40% of my token spend,” he said. “The problem isn’t how much they’re spending; it’s the uneven adoption of the technology. There’s a widening gap between the (agentic) haves and have-nots.”

He doesn’t treat that as a budget problem. In his telling, the gap pushed the industry toward what he called “the ill-fated tokenmaxxing fad.” He said encouraging engineers to use AI as much as possible to boost productivity is the “right sentiment, but the wrong metric,” and that counting dollars spent on tokens is a red herring that can be gamed.

“Now we’re correctly focused on upskilling developers – and this is precisely the market Coder opens,” he said, describing it as pairing Coder’s foundation with SpaceXAI’s agentic experience.

SpaceXAI is the first of several partnerships Coder is building around the argument that the best AI coding tools should run inside any organization, on any infrastructure, without the organization giving up control to get them. Coder Agent Relay for Cursor is currently in private preview with design partners.