Cursor

Cursor has evolved from an AI-enhanced editor into an agentic development platform spanning desktop IDE, CLI, web, mobile, cloud execution, code review and early-beta code hosting. The familiar editor still provides repository-aware chat, code generation and Tab-style predictive editing, but the strategic center of gravity is now agents that can plan, edit, run commands, test software and hand back pull requests.

Cloud Agents run in isolated virtual machines with cloned repositories, dependencies, secrets, startup commands and configurable network access. They can work while the user's local machine is offline, run in parallel, use browser/computer controls, attach screenshots/videos/logs, access MCP tools and coordinate changes across multiple repositories. This materially expands what Cursor can do, but it also means the product is no longer just an editor: it is an execution environment that can hold credentials, network access and write permissions.

Coder Agent Relay adds a materially different enterprise deployment option. In the current private preview, Cursor keeps the cloud-hosted agent session, orchestration, inference and planning, while a worker inside a self-hosted Coder workspace executes the agent's tool calls against code and infrastructure under customer-controlled networking, policy and lifecycle controls. Coder documents per-session workspaces, auditability and policy enforcement; it also explicitly says the provider-side orchestration and AI inference remain cloud-hosted. AiToolMap therefore treats Relay as customer-controlled execution, not as fully self-hosted Cursor or local inference. ¹²³

Cursor supports a broad model layer rather than forcing one foundation model. Current docs still list OpenAI GPT-5.6 Luna, Sol and Terra alongside Claude, Gemini and Cursor models. This flexibility is a practical strength, but model benchmarks should not be confused with an independent benchmark of the Cursor product itself; agent orchestration, context construction, tools, permissions and UX also determine real-world results. ⁴

There is now a material continuity caveat. OpenAI says it intends to wind down its custom direct model-supply agreement with Cursor after the SpaceX acquisition, with a proposed November 12, 2026 shutoff and no future OpenAI models supplied under that contract. OpenAI also says current access continues during the transition and that the official termination date is not yet confirmed. Users can continue OpenAI access through narrower routes including their own API key for supported chat/agent models, the Codex IDE extension or a compatible gateway. Cursor's own BYOK documentation makes the limitations clear: OpenAI custom keys cover standard non-reasoning chat models, not Tab completion, and provider data handling applies rather than Cursor ZDR. This is therefore a forward model-supply risk, not evidence that OpenAI models have already disappeared from Cursor. ⁵⁶⁷

Team functionality is now substantial. Teams include central billing/admin, internal marketplace rules/skills/plugins, Bugbot code review, cloud agents and automations, usage analytics, team-wide privacy mode and SAML/OIDC. Enterprise adds pooled usage, SCIM, repository/model/MCP access controls, browser/network controls, audit logs, service accounts, an AI code-tracking API and higher-touch support.

In August 2026 Cursor also launched Origin, an early-beta code-hosting layer for repositories, pull requests, code browsing and GitHub sync. That moves Cursor toward owning more of the software-development lifecycle rather than sitting on top of GitHub. Independent coverage from TechCrunch and InfoWorld confirms the strategic expansion while also noting that GitHub remains much more mature as a system of record. ⁸⁹

Current first-party pricing is usage-based by tier. Hobby is free. Pro is $20/month, Pro+ $60/month and Ultra $200/month. Cursor's help documentation also lists an India-only Start plan at ₹649/month. Teams Standard is $40/user/month and Teams Premium $120/user/month; Cursor's June 2026 pricing update lists annual equivalents of $32 and $96 respectively. Enterprise is custom-priced.

The subscription price is only the starting point. Plans include model-usage pools, and model choice determines how quickly those allowances are consumed. Cursor documents on-demand usage after included limits, charged at underlying model rates, with spend controls and visibility in the dashboard. Its own guidance says daily agent users often consume roughly $60–$100/month in total usage and power users running multiple agents or automations can exceed $200/month.

This makes value highly workload-dependent. Developers using Tab, light chat and occasional Agent work may stay within lower tiers; teams using expensive third-party models, parallel agents or automation need active budget governance. The low Trustpilot score is dominated by complaints about exhausted capacity, perceived pricing changes, refunds/support and stability, so billing clarity is not a peripheral issue even though Trustpilot's self-selected consumer corpus is not equivalent to a controlled product benchmark. ^1011412

The refreshed external corpus provides stronger independent numeric validation than the previous review snapshot, but the surfaces differ. The current Apple App Store listing for Anysphere's Cursor app shows 4.7/5 from 559 ratings; this is an exact-brand mobile surface, but it covers agent management and handoff rather than the full desktop/CLI platform, so it receives a reduced surface factor. G2's current Cursor aggregation is 4.5/5 from at least 60 reviews, while Gartner Peer Insights reports 4.5/5 from 143 ratings. PeerSpot reports 9.0/10 from only two reviews and therefore carries very little evidentiary weight. ^13141516

Capterra remains useful qualitatively for current verified-user themes, but the inspected surface did not expose a reliable current aggregate/sample pair; no number is invented. TrustRadius likewise provides current qualitative professional-user evidence, but the refreshed surface did not expose a reliable aggregate/sample pair, so the prior 9.5/10 figure is not reused as if freshly verified. ¹⁷¹⁸

Trustpilot remains sharply negative at 1.6/5 from 306 reviews, with complaints concentrated around billing/cost, support, bugs/crashes and agent quality. Under AiToolMap's rating methodology this numeric score is recorded as service-sentiment context but excluded from the product-rating equation; the self-selected support/billing surface is not treated as equivalent to verified product-quality ratings. ¹⁹

Editorial coverage also provides real product context. Reuters independently corroborates both the proposed OpenAI direct-supply transition and a separate August incident in which attackers used Cursor's coding agent during intrusions after bypassing safeguards through repeated framing. InfoWorld and Tom's Guide separately describe the OpenAI transition and continuity routes; TechCrunch documents the continued expansion into mobile agent management and automations. TechRadar has reported a destructive production incident involving an over-privileged coding-agent workflow, while The Register documented an earlier MCP persistence flaw that Cursor subsequently patched by requiring approval when MCP server entries change. These incidents do not prove normal Cursor usage is unsafe, but they reinforce that agentic coding tools combine large productivity upside with real credential, network and execution risk. ^202122232425

Agent Relay changes one important trust boundary for organizations that could not approve vendor-hosted execution. Coder's launch material and current documentation say tool execution can occur inside enterprise-controlled workspaces, with policy, network and audit controls applied there, while Cursor retains cloud-hosted orchestration and inference. Independent coverage describes the same split. That is a meaningful governance improvement for sensitive repositories, but the feature is still a private/closed preview and should not be generalized to every Cursor customer yet. ¹²³

Cursor's own cloud-agent security documentation describes isolated VMs, configurable network restrictions, secrets handling and private connectivity. It says Cursor is SOC 2 Type 2 compliant and undergoes at least annual third-party penetration testing; broader security materials also list ISO certifications. The correct enterprise posture is therefore not simply “Cursor is secure” or “agents are dangerous”: the product provides meaningful controls, but adopters remain responsible for least-privilege credentials, egress restrictions, review gates and separation from production systems. ^{2614171819202723242825}

Cursor is best for professional developers and engineering teams that want AI woven through the full implementation loop rather than bolted onto an ordinary IDE. It is especially compelling for repository-scale work where agents need to inspect code, edit across files, run tests and return verifiable artifacts.

Teams gain more than individuals because governance, shared context, cloud agents, Bugbot, usage analytics, SSO and admin controls increasingly form a coherent platform. Organizations already comfortable with Git workflows and code review can adopt it incrementally: keep human approval on pull requests while delegating bounded tasks to agents.

Regulated enterprises have an additional option in the Agent Relay preview: keep tool execution in a governed Coder workspace while preserving the Cursor Cloud Agent experience. The fit is strongest where the deployment boundary, network reachability and audit trail were the main blockers; organizations requiring local inference or a generally available self-hosted Cursor stack should not treat Relay as satisfying those requirements yet. ¹²

Cursor is less suitable for teams that cannot tightly govern credentials/network access, need fully predictable monthly costs, or require the most mature possible code-hosting ecosystem today. Origin is still early beta, and autonomous agents should not be granted broad production permissions merely because they can technically use them.