Cursor now supports realtime voice calls with agents in the Agents Window, IDE, web and iOS. The voice agent can hand coding work to the active agent, report progress and search prior interactions; Cursor says the feature runs on Grok Voice and uses zero data retention when Privacy Mode is enabled.
Why it matters: Voice becomes a live control and status channel for coding work rather than a dictation shortcut. That increases accessibility and speed, while making speaker identity, transcription, retention and accidental command boundaries part of the agent threat model.
Cursor's Build Live Apps flow lets a cloud agent scaffold an application, provision Postgres and authentication, run security checks and publish to managed hosting. Team administrators can inspect applications and secrets, add review rules, approve blocked publishes and unpublish an app.
Why it matters: The coding agent now crosses from repository edits into managed infrastructure and a public endpoint. That compresses delivery, but it also concentrates database, secret, identity and publishing authority in one workflow.
Cursor said a malicious Anthropic.claude-code 2.1.313 package was available in its extension marketplace for about 11 hours and reached at most 5,000 users. The package collected host details, added an SSH key and installed persistence; Cursor removed it, rebuilt the marketplace and published indicators and cleanup scripts.
Why it matters: AI-tool marketplaces can turn a familiar vendor name into a supply-chain execution path. Uninstalling is insufficient here because the payload drops independent persistence, so affected hosts need incident response and credential review.
Cursor cloud agents can now create shareable interactive canvases, while a beta Environments API can programmatically create and manage their execution environments. Cursor also raised the documented environment limit to 300 repositories and says large environments load five times faster.
Why it matters: The release turns cloud-agent setup and visual results into programmable, shareable workflow components. It also expands the blast radius of environment credentials and repository access, so permission design matters more than the headline capacity.
Cursor says Origin now integrates with more than 20 deployment, CI, code-review, security, monitoring and project-management apps, and it opened marketplace submissions to external developer-tool teams. Origin apps use app JWTs and installation tokens, receive webhooks, and can write checks, pull-request comments and reviews.
Why it matters: Origin can now act across a much broader delivery chain, while third parties gain a path to publish executable integrations. That makes installation scope, webhook provenance, token rotation and write permissions practical adoption decisions rather than…
Cursor's iOS app can now discover paired computers, show local agents running on them and send those agents messages. Execution remains on the user's computer, which must stay powered, online and awake; Enterprise organizations must explicitly enable Remote Control.
Why it matters: A phone becomes an intervention surface for agents holding local code, credentials and tools. That is useful for long-running work, but it expands the session, device-pairing and notification boundary without moving execution into an isolated cloud…
Cursor released two bots for Teams and Enterprise plans. Rollouts writes an editable monitoring plan for each pull request, follows the matching commit through deployment telemetry and reports healthy, regressed or inconclusive status per environment. Security Review inspects pull requests for exploitable flaws and posts one severity-rated review with an attack path and proposed fix.
Why it matters: The release moves coding agents beyond code generation into deployment verification and exploit-focused review. It can connect source, delivery and telemetry evidence on the pull request where a team decides whether to ship or revert.
Cursor launched Projects in beta with a coordinator that plans larger bodies of work, delegates implementation to cloud or local agents, and maintains shared files and learned context across machines. Projects can also subscribe to schedules, Slack channels and pull requests so work starts from external signals without a fresh prompt.
Why it matters: The feature combines durable memory, high parallelism and event-driven execution in one coding workspace, raising the leverage and the blast radius of stale context, excessive permissions or incorrect delegation.
Cursor added self-hosted machines for agent tool execution inside a customer's network. Code, build outputs and secrets remain on internal infrastructure while the agent issues tool calls locally, and teams can assign machines to managed pools.
Why it matters: Organizations with private networks or regulated build systems gain a deployment option that separates model orchestration from where code and credentials are executed.
OpenAI notified SpaceX that it intends to wind down the contract supplying OpenAI models to Cursor, with a proposed shutoff date of 12 November 2026. OpenAI says it will not provide future models to Cursor and attributes the decision to contract and terms-of-service concerns following SpaceX's acquisition of Cursor.
Why it matters: Cursor users and enterprises may lose a model route embedded in an important coding-agent workflow. The decision turns provider concentration, model fallback, reproducibility, procurement, and stored-agent behavior into a dated continuity issue.
Gambit Security and CloudSEK published evidence that a Russian-speaking Aurora ransomware affiliate used Cursor Agent during intrusions from April through July. The researchers describe credentialed reconnaissance, VPN and proxy setup, domain enumeration, NTLM relay and certificate attacks; Reuters reviewed underlying data and identified six victims, while reporting at least seven companies were breached with AI assistance.
Why it matters: It is concrete evidence of a general coding agent being used inside an interactive intrusion workflow. Existing credentials, routes, model output, identity, and administrative tools formed one attack system rather than a standalone malicious prompt.
xAI expanded Grok Bot beyond its early beta into enterprise availability and published a procurement pattern that separates always-allowed reads, per-action approval and prohibited commitments. Its internal example connected spend, contracts and usage data while reserving vendor sends, buying and charges for people.
Why it matters: Persistent computer agents now have a concrete enterprise route and a reusable method for separating research, external communication and binding financial authority.
Cursor introduced a new agent-centered workspace with multi-repository navigation, parallel local and cloud agents, handoff between those execution modes and a path back into the traditional IDE. Agents launched from desktop, web, mobile, Slack, GitHub and Linear appear in one interface, and cloud agents return demos and screenshots for review.
Why it matters: The developer interface is moving from one chat beside one repository to a control room for many asynchronous workers. Verification artifacts and handoff state become first-class UX, not afterthoughts.
Cursor released Composer 2 as its own coding model, trained with continued pretraining and reinforcement learning on long-horizon tasks. It was available in Cursor at $0.50 per million input tokens and $2.50 per million output tokens, with a faster serving tier at higher prices.
Why it matters: Coding-tool companies are becoming model developers, optimizing model, harness, repository context and interface together. Low prices can make persistent background coding viable if the model actually finishes tasks without expensive review or retries.
Cursor cloud agents gained the ability to run and use the software they created inside isolated virtual machines. They could return merge-ready pull requests with videos, screenshots, and logs, and were accessible from Cursor's web, desktop, mobile, Slack, and GitHub surfaces.
Why it matters: A coding agent could close the loop from implementation to visible runtime evidence, making reviews more grounded than a code diff alone.
Cursor released long-running agents that plan before acting and work autonomously on larger software tasks. The research preview was available through Cursor's cloud agents for Ultra, Teams, and Enterprise plans.
Why it matters: Coding-agent sessions began extending from quick edits into larger pull requests that could continue without a developer continuously present.
Cursor added distinct Ask and Plan modes to its command-line agent so developers could inspect a repository or agree on an implementation plan before edits began. It also added a handoff path that transfers a local CLI conversation to a cloud agent for background execution.
Why it matters: Coding-agent work could move from local discovery and approval into isolated asynchronous execution without rebuilding the task context.
Cursor released Agent CLI in beta, bringing its coding agent to terminals and headless environments with repository editing, command execution, model choice, and parallel-agent workflows.
Why it matters: Coding agents stopped being confined to an IDE panel and became composable workers that could enter scripts, CI jobs, remote machines, and multi-agent development loops.
Cursor began gradually previewing Background Agent on May 15 with parallel remote environments, status checks, follow-ups, and takeover. On May 19, GitHub put Copilot coding agent into public preview, letting users assign issues that produced tested draft pull requests in a GitHub Actions environment.
Why it matters: Coding assistance became asynchronous delegation: the unit of value shifted from an inline suggestion to a reviewable pull request created while the developer did other work.