Cursor's self-hosted agent workers still send file contents and diffs back to its cloud

The full checkout, the build cache and machine-local credentials do stay on the worker, which is the part of the changelog's claim that holds ^[5]. The arithmetic on the wire is where it comes apart. Cursor's docs require outbound HTTPS to three hostnames: `api2.cursor.sh` and `api2direct.cursor.sh` for the agent session, and `cloud-agent-artifacts.s3.us-east-1.amazonaws.com` for artifact uploads ^[7]. One of the three is optional. Block the bucket and artifact uploads stop while tool calls and their results keep working ^[8]. Two mandatory destinations remain, and they are the ones carrying session content ^[19]. So the operator, not egress policy, decides what reaches Cursor, per the docs' single line about keeping secrets out of tool output ^[6].

For whoever writes the firewall rules, the shape is a worker that dials out. `agent worker start` opens a long-lived outbound HTTPS connection and Cursor pushes tool calls down it, with no inbound ports, no public IP and no VPN tunnel ^[9]. Cursor never initiates a connection into the network ^[9]. A perimeter review looking for inbound exposure finds nothing, while terminal commands from outside arrive inside a session the proxy logs as ordinary HTTPS ^[2].

The documentation names three reasons to self-host: code or services that cannot be reached from outside the network, custom hardware such as GPU machines or Macs for iOS work, and custom images such as a different operating system or an existing build pipeline ^[3]. Data boundary is absent from that list ^[20], and Cursor writes the counter-argument itself: you don't need to own the compute to keep agents inside your security perimeter, followed by the managed controls said to cover it, among them an isolated VM per agent, outbound allowlists scoped by user, team or environment, AWS PrivateLink or Cloudflare Tunnel to GitHub Enterprise Server and GitLab Enterprise, Privacy Mode and customer-controlled secrets ^[10].

One configuration moves isolation backwards. My Machines lets several agents run on the same machine ^[11], where managed Cloud Agents get a VM per agent that Cursor provisions and tears down ^[10]. Team Pools puts it back to one agent per machine, with service account authentication and centrally managed images ^[11], and the anysphere/k8s-workers template creates one worker Pod per claimed request ^[12]. "Your machine" also stretches: the docs accept a VM from a partner host such as AWS Lambda, Cloudflare, Namespace, Modal, Daytona, E2B or Vercel ^[13], so self-hosted compute can still sit in someone else's tenancy.

No vulnerability is at play here, and no patch deadline applies. What a security team signs for is a worker that executes terminal commands issued by a loop it does not run ^[2], and that can click, type, take screenshots and drive a browser on Linux and Mac under that loop's control ^[16].