Cursor self-hosted machines move cloud-agent tool execution into infrastructure you control. Code, build outputs, and secrets can stay on internal workers while Cursor orchestrates the job. That reduces one data path, but it also turns your worker pool into a production security boundary.
The September 2 release supports a single laptop or VM through My Machines, team and enterprise worker pools, existing sandbox providers, and computer use on Linux and Mac. Cursor says pools can grow as workers connect, shrink when they disconnect, and hibernate idle machines until a follow-up arrives.
What Cursor self-hosted machines change
In the hosted pattern, an agent’s shell, browser, files, and tools run in infrastructure operated by a vendor or a sandbox partner. With a self-hosted worker, those tool calls execute on a machine inside the customer’s environment. The agent can work against private repositories, internal build systems, and local resources without copying the whole runtime into a vendor-controlled machine.
Cursor lists integrations with AWS Lambda, Coder, Cloudflare, Daytona, Modal, Namespace, Vercel, and E2B. That list describes supported execution options, not identical security properties. Each provider has different identity, network, persistence, logging, and isolation behavior.
| Mode | Useful for | Main control to verify |
|---|---|---|
| My Machines | One developer, laptop, or dedicated VM | Local account isolation and unattended access |
| Team pool | Shared queue of workers across repositories | Job-to-worker identity and residue between jobs |
| Existing sandbox provider | Elastic or specialized execution | Provider boundary, regional data path, and logs |
| Computer use | Desktop apps and browser workflows | Session credentials, screenshots, and external actions |
Self-hosted execution is not fully local inference
The release says tool execution stays in your network. It does not say every prompt, model input, orchestration decision, or telemetry event stays there. A self-hosted shell is different from a self-hosted model and different again from an entirely offline control plane.
Before deployment, document which data reaches Cursor and the selected model provider. Include prompts, file excerpts, command output, screenshots, browser content, error logs, repository metadata, and usage analytics. If a compliance decision depends on residency or retention, verify the contract and network trace instead of inferring it from the word “self-hosted.”
Worker identity should be per job
A shared worker can become a bridge between repositories if credentials, caches, environment variables, browser profiles, package registries, or build artifacts survive after a job. Pool scheduling increases that risk because any available worker can claim a request.
- Issue a short-lived identity for one job and one repository.
- Mount only the secrets required by the current tool call.
- Clear the workspace, browser profile, caches, and agent notes before reassignment.
- Revoke credentials and network grants when the job ends or is cancelled.
- Record which worker, image, identity, and policy executed each step.
Do not rely on a cleanup script as the only boundary. Prefer disposable workers or verified snapshots for higher-risk repositories. If a machine hibernates for follow-up work, make the persistence window explicit and bind reconnection to the same task identity.
Computer use expands the trust boundary
On Linux and Mac, a worker can click, type, take screenshots, and drive a browser when the required desktop packages are present. Cursor lets an operator watch the desktop or take control. This is useful for frontend tests and internal applications, but a signed-in browser can expose far more authority than a repository token.
Use a dedicated profile with no personal sessions. Allowlist destinations. Require confirmation before sending messages, publishing, paying, deleting, inviting users, or changing account security. Screenshots and copied text should be treated as sensitive logs.
Network placement matters more than ownership
A machine inside the corporate network may reach databases, package mirrors, staging systems, metadata services, and employee tools that a hosted sandbox cannot see. Moving the worker inward can therefore increase blast radius even while reducing external data movement.
Place workers in a dedicated segment with default-deny egress and explicit routes to the required repository, package sources, test services, and observability endpoints. Block production credentials unless a separate approved workflow needs them. Our agent containment incident guide shows how permissive egress and reusable identities can turn an evaluation mistake into a real external action.
Pool economics require cold-start measurements
Hibernation can reduce idle compute, but the saving depends on reconnect time, image size, dependency caches, and how often a follow-up arrives. A team should measure warm task latency, cold task latency, hourly worker cost, idle share, cache-hit rate, and failure rate after resume.
Autoscaling does not remove model cost or human review. Track cost per accepted change across worker compute, model calls, storage, network traffic, retries, and reviewer minutes. Our AI agent cost-control guide provides the budget gates to put in front of an elastic pool.
A deployment test before connecting a private repository
- Create a disposable repository with seeded fake secrets and canary files.
- Run two jobs from different identities through the same pool.
- Verify that the second job cannot read the first job’s files, environment, cache, browser state, or logs.
- Attempt access to blocked network destinations and cloud metadata.
- Cancel a task mid-command and confirm credential revocation, process termination, and evidence capture.
- Hibernate and resume a worker, then check whether the persistence matches the documented window.
- Export the audit trail and reconstruct who approved each consequential action.
My verdict: bring the worker closer, shrink its authority
Cursor self-hosted machines can solve a real enterprise problem: agents need tools and private build environments without moving the whole execution layer outside the network. The feature does not make the agent trusted. It makes the customer’s infrastructure responsible for isolation, identity, and recovery.
Start with one disposable pool, one repository class, and no production access. Prove job isolation, network policy, cleanup, auditability, and cost under failure. Then expand the pool according to risk, not convenience. A self-hosted worker should be easier to constrain and investigate than the hosted path it replaces.
Read the release and security context
- Read Cursor’s self-hosted machines changelog.
- Review Cursor’s security documentation before connecting internal systems.
Checked September 4, 2026. Supported modes, providers, hibernation, and computer-use behavior come from Cursor. Isolation, network, and cost tests are Musthave.ai analysis.
