Cursor said cloud agents now author more than half of the pull requests merged into its own monorepo, up from roughly one in ten in December. The company frames the jump as an environment story rather than a model story: nothing about the underlying model changed, but the computer the agent works inside did. That distinction is the whole argument of Cursor’s post.
As with a separate agentic-coding story in today’s issue, the harness and the environment, not the model, decided the outcome here too.
Cursor’s engineers started by making the cloud match local development. Most Cursor developers work on Macs, but the company’s cloud virtual machines run Linux, so setup scripts and dev utilities had to be rewritten to work on Ubuntu. The team built a Cursor-defined Dockerfile as the starting image for every cloud agent, baking in the dependencies a human developer would otherwise install by hand.
Security came next, because giving agents a computer means giving them access to secrets. Cursor now caps how much outbound traffic a VM can send, routes git remote access through a scoped proxy instead of a raw credential, scans every commit and its message for leaked secrets, and strips credential values out of whatever gets returned to the model so an agent cannot read one even by asking. Those controls let engineers inject real credentials into an agent’s environment without treating every run as a leak risk.
Even with a working Ubuntu setup, agents still struggled to run Cursor’s code, because the build process required memorizing scattered flags and utility scripts. Cursor’s fix was a CLI called anydev that consolidates every build and run command behind one interface, with a --help menu on each subcommand and a supervisor process that restarts long-running builds on its own. Removing that babysitting from the model, rather than asking the model to get better at it, is what let agents test and verify their own changes end to end.
The last two changes target upkeep rather than setup. Cursor built a tool called Cursor Cloud MCP that gives an agent a way to check up on its own machine: whether the build has broken, whether the egress rules have moved, whether a credential got rotated out from under it. The team picked MCP for this because its tool interface can be swapped and extended on the fly, without touching the code that runs the agent’s core loop. On top of that, an automation called Cloud Doctor periodically checks for failures, distinguishes transient errors from real ones, and opens pull requests to fix problems with high confidence. Cloud Doctor also reviews traces from other agents’ runs to find which skills or commands misled them, then rewrites those skills so the next agent does not repeat the mistake.
This is Cursor’s own figure, measured on Cursor’s own repository, reported without an outside audit. Merged pull request share is a measure that can move for reasons that have nothing to do with agent skill: which tasks get routed to an agent in the first place, and whether reviewers loosen their bar as trust in the system builds. Cursor’s post does not break out task difficulty or reviewer approval rates alongside the headline number, so the majority-of-PRs claim should be read as a description of Cursor’s internal workflow, not a benchmark that transfers directly to another company’s codebase.
Cursor closes with three questions for other engineering teams: do agents have the same tool access as a developer, can they find skills that document how the team actually works, and can they test and verify core workflows on their own. Teams piloting cloud coding agents should run that same audit on their own repository before spending the next quarter chasing a bigger model, since Cursor’s numbers suggest the ceiling on agent-authored code is currently set by devex work, not model capability.
Cursor detailed these changes in a company blog post published on cursor.com.
