Cursor Self-Hosted Machines: Run Cloud Agents on Your Servers

Cursor’s cloud agents have been enterprise-blocked since day one. Your codebase, build secrets, and internal APIs live inside your network. The moment an AI agent tries to reach them from Cursor’s cloud, your security team’s answer is no — and they’re not wrong. On September 2, Cursor addressed this with a meaningful update to self-hosted machines: team-scale worker pools with autoscaling, hibernation, and computer use on Linux. The data residency argument against Cursor just got much harder to make.

What Cursor Shipped

The update has four moving parts. Team Pools are named queues of worker machines that serve entire teams — not just individual developers. Workers scale out as requests arrive and scale in when idle. Machines hibernate to a snapshot and restore within a reconnect window, so you’re not keeping expensive compute warm for the next prompt. Computer use on Linux and macOS is now available for self-hosted workers, letting agents click, type, drive a browser, and take screenshots. Observers can watch the agent’s desktop or take control from Cursor.

Eight infrastructure providers launched same-day integrations: AWS Lambda, Coder, Cloudflare, Daytona, Modal, Namespace, Vercel, and E2B. You’re not required to run your own servers. If your team already uses Cloudflare Workers or Modal, your existing cloud infrastructure works as the worker substrate.

What “Self-Hosted” Actually Means Here

This distinction matters for your security review. Cursor’s cloud handles model inference and orchestration — the AI reasoning layer. The self-hosted worker handles execution: cloning repos, running commands, editing files, running builds and tests, calling your internal APIs. Workers connect outbound to Cursor over HTTPS. No inbound ports required. Your source code, build outputs, and secrets stay inside your network.

What does not stay inside your network: model API calls. Inference still routes to Anthropic, OpenAI, or whichever model backend Cursor is using. If your organization requires full air-gap — no data touches any external service — this does not solve that. If your requirement is “our source code never leaves our infrastructure,” this does.

Deploying at Team Scale

For Kubernetes environments, Cursor provides a Helm chart and operator. You define a WorkerDeployment resource, and the controller handles scaling, rolling updates, and lifecycle management. Minimum requirements: four vCPUs and 16GB RAM per replica, Kubernetes 1.24+, Enterprise license.

pool:
  name: "engineering-pool"
  replicas: 4
  hibernation:
    enabled: true
    reconnectWindowSeconds: 300

helm repo add cursor https://charts.cursor.com
helm install cursor-workers cursor/worker-pool -f values.yaml

For teams not on Kubernetes, a fleet management API exposes utilization metrics and autoscaling hooks for any infrastructure. The smallest viable setup is a single EC2 instance running the cursor-worker Docker container — one host, one worker, connecting outbound over HTTPS. Separate pools for different environments are supported: a gpu pool for ML workloads, an ios pool for Mac builders, a standard pool for general tasks.

Where Cursor Stands Against Alternatives

The self-hosted AI coding agent space has gotten crowded fast. Windsurf Enterprise offers on-premise execution with FedRAMP certification, relevant for government work. Claude Code Self-Hosted Runner launched in August. Continue paired with Ollama offers fully local inference — the only current option for true air-gap. GitHub Copilot remains cloud-only with no self-hosted execution path.

Cursor’s position: if your team has been using Cursor for developer velocity and hitting the enterprise security wall, this update removes that wall. It is not the most isolated option — Continue with local models wins on isolation — but it is the most capable agent platform that now meets regulated-industry requirements for code residency.

The Broader Picture

Roughly 88% of enterprise AI agent pilots never reach production. The consistent blocker is infrastructure: isolation, compliance, data residency requirements that security teams need before any agent touches production code. Self-hosted execution is the unlock for those stalled pilots. Cursor has now made that play directly, roughly in parallel with Windsurf’s enterprise push and four months after Claude Code’s self-hosted runner.

The limitation worth naming: model inference is not self-hostable in Cursor. Your code stays in your network; the AI’s thinking does not. For most regulated enterprises, that is an acceptable trade. For organizations with the strictest classification requirements, it remains a gap.

The full details are in Cursor’s official announcement, with Team Pools documentation at cursor.com/docs. The Cloudflare integration went live the same day. Enterprise license required for team pools; personal My Machines mode is available on lower tiers.