Coder's Agent Relay runs Cursor on your own infrastructure — but the reasoning loop still leaves the building

What was announced

Coder — the self-hosted development-environment company — put out Agent Relay via newswire on 2 September 2026, with SD Times picking it up on the 3rd and Coder’s own detailed engineering post landing on the 4th. The launch partner is SpaceXAI, which has owned Cursor since the $60 billion Anysphere acquisition in June.

The product does one specific thing: it lets Cursor Cloud Agents run inside Coder workspaces on infrastructure the customer already operates. Developers keep the Cursor experience across app, web and mobile. The agent’s actions happen on the customer’s network.

Coder CEO Rob Whiteley framed the thesis crisply: “Enterprises never rejected AI agents. They rejected the deployment model… Those are infrastructure questions, and Coder was built to answer them.”

That diagnosis is correct, and it is why this is worth a buyer’s attention rather than a shrug. The target list — banks, defence agencies, government institutions — has not been holding out because agentic coding looked useless. It has been holding out because a vendor-hosted process with repository access, live credentials and a shell is not a shape their controls can accept, regardless of how good the model is.

The split, precisely

Coder’s engineering documentation is unusually straightforward about the architecture, which makes the boundary easy to state accurately.

And the sentence that decides how a security review should read all of it, from Coder’s own docs: “The agent provider still runs the reasoning loop, and LLM inference calls still route through the provider’s infrastructure.”

Credit where it is due — a vendor that writes that down in its documentation, on the same week it markets the product to defence agencies, is being more candid than the category norm. But it does mean the word “self-hosted” in the product framing is carrying more weight than the architecture supports, and it is worth being precise about which half is which.

Execution came home. Context did not.

Two code paths are easy to conflate, and conflating them is how a control objective gets signed off against an architecture that does not meet it.

What stops leaving: the repository at rest, secrets, internal service reachability, the shell the agent runs commands in, and the record of what it did. None of that transits to a vendor. The agent daemon connects outward from your network; you never open an inbound path, never mint vendor-accessible credentials, and never expose an internal endpoint. If an agent goes wrong, the blast radius is bounded by a workspace whose firewall rules you wrote.

What still leaves: the context the model needs in order to reason. File contents, diffs, error output, whatever the agent pulls in to decide its next move — that goes to the vendor’s cloud, because that is where the reasoning loop lives. There is no version of this architecture where it does not, short of running the model itself locally, which is a different product with different tradeoffs entirely.

So SpaceXAI’s Toni Adams is describing a real customer requirement — “Enterprise security policies require that sensitive information not leave its own infrastructure” — against an architecture that satisfies part of it. Whether that part is the part you needed is a question only your own data classification can answer, and it should be answered in writing before evaluation rather than inferred from a press release afterwards.

Which risk this actually retires

The useful way to read Agent Relay is not “is it really self-hosted” but “which of my two coding-agent risks does it address.”

Blast radius — addressed, substantially. This is the risk that an agent with repository access and a shell does something reachable and irreversible: touches production, exfiltrates a credential, follows an instruction it should not have. It is the failure mode behind the memory-poisoning connector research on Copilot and the practical lesson of the Langflow CVE that burned self-hosted OpenAI and AWS keys. Moving execution onto infrastructure you control, with your firewall, your RBAC and your audit trail, is a genuine and large mitigation. It also gives you something vendor-hosted agents structurally cannot: a local, complete, SIEM-ingestible record of what the agent did, attributed to the human who asked for it.

Confidentiality in transit — unchanged. Your code still goes to a third party to be reasoned about. If that was already acceptable under an existing Cursor agreement, nothing here degrades it. If it was the blocker, this does not remove it.

There is also a third thing worth noticing, which is availability. Running execution on your own infrastructure decouples you from part of the vendor’s uptime — though only part, since the reasoning loop remains a hard dependency. Anyone who lived through the Git-forge outage that stranded agentic workflows in August will recognise that this narrows the failure surface without closing it.

The cost angle nobody asked for but everyone needs

The New Stack’s coverage of the launch led with a line about the concentration of token spend — that a very small fraction of engineers account for a disproportionate share of it. Whoever said it, the phenomenon is real and under-instrumented across every team running coding agents at scale, and it is the quiet reason finance teams get surprised by agentic tooling bills two quarters in.

A self-hosted execution layer is the natural place to fix that, because it is the one component that sees every agent action and belongs to you. Per-user and per-repository spend visibility should be an explicit pilot requirement rather than a feature you hope ships later.

What to do about it

1. Write your data classification down first. Decide, in advance and on paper, whether your control objective is “no third party processes our source” or “our credentials, internal systems and build environment are unreachable from a vendor cloud.” Agent Relay fails the first and passes the second. Most reviews go wrong by never making the distinction explicit.
2. Ask for the data-flow diagram, not the summary. The summary is where the ambiguity lives. The diagram will show the inference path immediately.
3. Negotiate the inference-path terms now. Retention and training commitments for prompt content, regional routing, and audit rights are the terms that matter most and the ones not yet published. Private preview is when they are negotiable.
4. Set the workspace egress policy deliberately. The execution environment is on your network, which means its outbound rules are yours to define — and a default-open workspace gives back much of what the architecture just bought you.
5. Do not wait on it for a decision you need this quarter. Private preview, no GA date, no pricing. If a regulated team needs an answer now, the comparison set still includes running a different agent entirely rather than a different deployment model for Cursor.

The bottom line

Agent Relay is a real answer to a real objection, and Whiteley’s framing — that the deployment model was the blocker, not the technology — is the most accurate sentence any vendor has said about why agentic coding stalled in regulated industries.

It is also a partial answer, and Coder’s documentation says so more plainly than its press release does. Execution moved onto customer infrastructure. Reasoning did not. That buys a large reduction in blast radius and a complete local audit trail, and it buys nothing at all on whether your source code is processed by a third party.

Both of those are worth having. Only one of them is what “self-hosted” usually means, and the gap between the two is where a compliance sign-off goes wrong.

Questions or corrections? Email Pick Right. Want the full list? See all news.