Cursor shipped Self-Hosted Machines this week, and it closes one of the last remaining arguments that regulated enterprises had for staying off AI coding agents entirely. The feature keeps Cursor's agent loop, inference, and planning in Cursor's cloud while routing all tool calls, file edits, and repository side effects through hardware you control. That is not a minor configuration option. It is a structural shift in how Cursor competes for enterprise accounts, and it arrives the same day Coder announced its own Agent Relay in private preview. The timing is not a coincidence.

If you lead engineering at a company with any meaningful compliance posture, read this before your security team asks you why your IDE is touching production repos from a cloud you don't own.

Cursor's Self-Hosted Machines gives teams two execution paths: My Machines for individual developers running the worker on their own hardware, and Team Pools for organizations that want centrally managed execution infrastructure. The architecture is cleaner than it sounds. The worker on your machine opens an outbound connection to Cursor's control plane and requires no inbound ports, no public IPs, and no VPN tunnels. Outbound HTTPS access to four endpoints covers the full requirement: `api2.cursor.sh`, `api2direct.cursor.sh`, `downloads.cursor.com`, and `cloud-agent-artifacts.s3.us-east-1.amazonaws.com`. Your network team can allowlist those and call it a day. For teams running on Cloudflare's infrastructure, Cursor's integration tutorial shows each assigned session running in an isolated Cloudflare container, with the customer controlling the execution environment while Cursor handles orchestration above it. This requires a Cursor Enterprise plan with the self-hosted machines feature enabled and a team service-account API key scoped to agent operations. The critical distinction for security reviews: model inference still leaves your boundary. Cursor's planning layer runs in their cloud. What stays inside your environment is the execution: the actual shell commands, file writes, test runs, and API calls the agent makes. For most compliance frameworks, that is where the meaningful risk lives.

The objection that has killed more AI coding tool rollouts than any other is not about model quality or developer experience. It is: "The agent needs write access to our codebase and it runs on infrastructure we don't control." Self-Hosted Machines directly answers that objection. Consider what "execution in your environment" actually means operationally:

This is not a privacy feature. It is an operational control feature, and that distinction matters when you are writing the internal justification for platform adoption.

That quote deserves real weight here. Self-Hosted Machines is new. The right question to ask Cursor's enterprise team is not whether the feature exists today but what the release cadence looks like for self-hosted customers six months from now. Get that answer in writing before you standardize on it.

The announcement that Coder launched Agent Relay on the same day as this coverage is the most strategically interesting detail in this story. Coder is positioning itself as the compliance execution layer for Cursor in regulated enterprises, essentially arguing: "You love Cursor's experience, but let us own the boundary that your security team cares about."

That is a credible bet. Coder already has relationships with platform and security engineering teams at large enterprises through its remote development environment product. Agent Relay in private preview means they are in design partner conversations right now, shaping the feature around real enterprise requirements. If you are in a regulated industry, it is worth joining that waitlist even if you end up not using it, because the conversations will tell you what the real compliance requirements look like in practice.

Here is how the execution control options compare as of today:

No single option wins across every dimension. Copilot with self-hosted runners gives you mature execution control but a weaker agent loop. Claude Code keeps inference off a third-party agent cloud but loses the IDE integration that drives developer adoption. Cursor Self-Hosted Machines gives you the best developer experience with meaningful execution control, at the cost of inference still leaving your perimeter. For most engineering teams, the inference-leaves-boundary tradeoff is acceptable. The models need to see your code to reason about it. If your threat model prohibits that entirely, you are looking at a fully air-gapped stack, and none of these tools solve that problem today.

Self-hosting execution infrastructure is not free. But the math changes significantly when you factor in the token economics of running agents at scale. If your teams are running hundreds of agent sessions per day, the cost differential between managed and self-hosted compute becomes visible fast.

Self-Hosted Machines does not change your model inference costs directly, since Cursor still runs that layer. But it changes how you think about compute investment for execution environments. Teams with existing internal GPU capacity or strong VPC infrastructure will find the operational overhead of running the worker is low. Teams starting from zero should factor setup and maintenance into their adoption timeline.

This is not a "wait and see" situation. The feature is generally available for Enterprise customers and the security conversation it unblocks is one that has been delaying AI coding tool adoption at regulated companies for two years. Move on it now or watch your competitors move first. Here is a concrete pilot structure:

If you are not on Cursor Enterprise, this is also a forcing function to have that conversation. The self-hosted execution model is an Enterprise-only feature, and the compliance value it unlocks is worth the contract.

Most coverage of Self-Hosted Machines will frame it as a privacy feature. That framing is incomplete. The more consequential shift is organizational: this feature makes platform engineering and security engineering first-class buyers of AI coding tools, not just individual developers. Until now, AI coding tool adoption has largely been a bottom-up motion. Developers adopt Cursor personally, demonstrate productivity gains, and then push leadership to approve it. That path hits a wall at regulated enterprises because the approval chain runs through security teams who have legitimate objections to cloud-executed agents with repository access. Self-Hosted Machines gives platform teams something to evaluate on their own terms. The networking model is simple enough to assess quickly. The execution boundary is clear enough to write a security review around. The Cloudflare integration gives teams with existing Cloudflare infrastructure a familiar deployment pattern. This is how enterprise software adoption works at scale. You solve the bottom-up developer experience first (Cursor has done that), and then you give the infrastructure and security stakeholders a model they can approve. Cursor has now done both. The teams that move fastest on this will be the ones that treat it as a platform engineering project from day one, not a developer tools experiment. Deploy the Team Pool. Instrument it. Build the audit logging integration. Make the AI coding agent a managed, observable piece of your infrastructure rather than a shadow tool running on individual laptops. That is the architecture of a team that will still be compounding its AI advantage in eighteen months while others are still waiting for security sign-off.