Scale · founder · 8 min read

Your Code Has a Landlord. Cursor Just Offered to Be a Second One.

Cursor launched Origin, its own code host, during a GitHub outage. Here's what code custody actually means for a non-technical founder.

Published August 20, 2026 ·

cursor github code custody portability founders vendor risk

On Monday, August 17, Cursor started rolling out Origin — its own code-hosting platform. Repos, pull requests, code browsing, the works. About three and a half hours later, GitHub fell over for most of a workday.

The coincidence got all the coverage. It’s the least interesting part of the story.

The interesting part is a question most non-technical founders have never had to ask: where does your code actually live, and who has custody of it? If you built your app with Lovable, Bolt, Replit, or Cursor, there is a repository somewhere with your entire product in it. You probably clicked “connect GitHub” during onboarding and never thought about it again. This week is a decent moment to think about it.

What actually shipped

Let’s be precise, because the headlines weren’t. Cursor’s own changelog says the quiet part plainly: “Pushes keep going to GitHub, which stays the source of truth for anything started there.”

Origin, as shipped on August 17, is a mirror with a nice interface on top. It lives in a new Codebase tab inside Cursor. You can create repos, open and review pull requests, browse and search code, push and clone with ordinary git, and sync an existing GitHub repo in both directions — including PR comments. Vercel, Depot, and Buildkite work on day one, and Depot and Buildkite run your existing GitHub Actions workflows unchanged.

It’s in early beta. It’s on Pro, Teams, and Enterprise — not the free plan. There’s no separate price; it’s bundled into what you already pay. Enterprise admins can switch it off for their org.

The part that would actually justify the “GitHub killer” framing — what Cursor calls “agent-native features” — has not shipped. Cursor says it’s coming “soon.” So the thing everyone is arguing about doesn’t exist yet.

Why Cursor is doing this at all

Two reasons, and both are real.

GitHub is genuinely struggling. LeadDev, drawing on IncidentHub data, counted 257 GitHub incidents between May 2025 and April 2026 — 48 of them major. That’s roughly one significant disruption a week. The August 17 outage ran several hours with web and API error rates around 20% and archive downloads near 50%. GitHub’s own CTO has said publicly that the platform “wasn’t built for the scale it’s now being asked to handle,” and GitHub’s engineering blog acknowledged breaching its own enterprise SLAs in February and March. GitHub has had no CEO since August 2025; Microsoft folded it into its CoreAI org instead of replacing him.

The traffic changed shape. GitHub’s core is a Ruby on Rails monolith designed in 2008 around a human opening a pull request, a human reading a diff, and a human clicking merge. That cadence assumed humans type at human speed. Agents don’t. AI-agent pull requests reportedly went from roughly 4 million a month in September 2025 to over 17 million by March 2026. Inside Cursor, agents now open about 35% of merged PRs. A review queue built for conversation becomes a scheduling problem.

So the architectural argument for a purpose-built host isn’t marketing. It’s the most credible thing about Origin.

The part nobody is covering, and the part that matters to you

Here’s what should give you pause.

Origin rolled out opt-out by default to paid plans. And as of launch, Cursor has not published data retention terms, training-use policies, subprocessor disclosures, or export tooling for code hosted natively on Origin — as distinct from code mirrored in from GitHub, where GitHub’s terms still govern.

That gap would matter at any time. It matters more right now because the owner changed three days before launch. SpaceX’s acquisition of Anysphere (Cursor’s parent) legally closed August 14 per its SEC Form 8-K, at an implied $60 billion equity value. Cursor is now a wholly owned subsidiary inside a division called SpaceXAI — the same corporate family that absorbed xAI.

Cursor’s existing privacy documentation distinguishes Privacy Mode on (zero retention, no training use, the Enterprise default) from Privacy Mode off, where Cursor may store and use your codebase data, prompts, and editor actions to improve and train models. On individual Pro plans, Privacy Mode is off by default. Those terms were also written to cover code passing through the editor for inference — not code stored on Cursor’s servers as the repository host. Those are different things, and the second one has no published answer yet.

None of this means Cursor is doing something sinister. It means a policy document that should exist doesn’t exist yet, and you shouldn’t put proprietary code somewhere while that’s true.

What to actually do this week

If you don’t pay for Cursor, nothing here requires action. Read the last section anyway.

If you do pay for Cursor:

1. Check whether you’re enrolled. Origin is opt-out, not opt-in. Open the Codebase tab and see what’s there.
2. Mirror, don’t migrate. If you want to try it, sync one repo and leave GitHub as the source of truth. That’s the default behavior and it’s genuinely reversible.
3. Don’t create Origin-native repos for anything real. Not proprietary code, not repos with customer data in test fixtures, not anything with credentials buried in commit history. Wait for published terms.
4. If you have a team, make the toggle a decision. Enterprise admins can disable Origin from the dashboard. Choosing to allow it is fine. Not noticing it exists is not.

The bigger lesson: run a portability check

Forget Cursor for a second. The useful thing this week surfaced is that most founders who built with AI tools have never checked where their code lives or how hard it would be to move it. Take twenty minutes and answer these:

Can you clone your repo right now, from a terminal, without opening your builder tool? If the answer is “I don’t know,” that’s the answer. Every serious builder — Lovable, Bolt, Replit, Cursor — offers GitHub sync or export. Turn it on and confirm it works before you need it.

Do you have a copy that isn’t controlled by the company that made your app? A GitHub repo you own is a copy. A repo that only exists inside your builder’s dashboard is not.

Where does your database live, and can you export it? Code is usually the easy part. Your data is the part that’s genuinely hard to move, and it’s the part people forget.

Who is your host’s landlord? GitHub is Microsoft. Origin is SpaceX. Your builder tool may be owned by someone different than it was six months ago — this category has been consolidating all year. That’s not automatically bad, but it’s worth knowing.

The founders who get hurt by vendor changes are rarely the ones who picked the wrong tool. They’re the ones who never checked whether they could leave.

The bottom line

Origin is a well-scoped early beta that mirrors GitHub rather than replacing it, and it’s free to try if you already pay for Cursor. The architectural case behind it is sound, and GitHub’s reliability problems are real, not manufactured.

But it shipped opt-out by default, with no published data terms, three days after being acquired by SpaceX. The right posture is mirror-only until Cursor publishes terms — and then read them.

And if this whole story made you realize you’re not sure where your own code lives, that’s the actual takeaway. Go find out. It takes twenty minutes and you only regret skipping it once.

Related reading: Picking AI tools that will last, The defensibility audit, and our Cursor review.