Cursor started rolling out Origin, its own code hosting platform, on Monday morning. About three and a half hours later GitHub fell over.

The order matters, because most of the internet reversed it.

Matt Palmer works at Cursor. He quote-tweeted his own company’s launch with a line that then travelled further than the product. Cursor meant to ship earlier, he wrote, but GitHub was down.

It is a joke, and a good one. Origin had already shipped. Michael Nuñez laid out the sequence for VentureBeat. He called it the day’s best line. He also noted that companies lock launches weeks ahead.

No evidence suggests Cursor timed this. The coincidence simply did the company an enormous favour.

What actually broke

GitHub’s degradation ran six hours and forty-two minutes, resolving at 20:22 UTC.

Error rates hit roughly 20% on pull requests, issues and the API. Archive and raw file downloads hit about 50%. Enterprise single sign-on went with it, so SAML, OIDC, SCIM provisioning and Team Sync all failed. Copilot failed too.

It was the seventh incident on GitHub’s status page in fifteen days.

The wedge is the design

Cursor Origin gives you repositories, pull requests, code browsing and search. The interesting decision is what it does not ask for.

Cursor does not ask you to leave GitHub. You connect an organisation, pick repositories, and they appear alongside Origin-native ones. Permissions mirror GitHub’s existing read and write settings rather than creating a parallel system.

Pushes keep going to GitHub, and the changelog says GitHub stays the source of truth for anything started there. Pull request comments sync both ways within seconds.

Depot and Buildkite run your existing GitHub Actions workflows unchanged. Vercel handles preview deployments.

That compatibility is the entire strategy. Ripping out source control is one of the riskiest projects an engineering team can attempt. Almost no chief technology officer approves that for an early beta. A read-mostly mirror approves itself, costs nothing to try, and quietly relocates where developers spend their day.

The agent argument is real

Cursor announced Origin in June at its first developer conference. It pitched the product as a git forge for the agentic era. The demo ran agents at 22.6 commits per second against one repository.

The supporting number beats the demo. RuntimeWire reported that agents running autonomously in cloud machines now open 35% of the pull requests merged inside Cursor.

A forge built for humans assumes a pull request carries human intent. You can ask the author what they meant. Once a third of merged changes come from software, the review queue stops being a conversation. It becomes a scheduling problem.

The wider data supports the strain. Google’s 2025 DORA report found AI adoption tracking positively with delivery throughput and negatively with delivery stability. Stack Overflow’s survey of 49,009 developers found trust in AI accuracy falling to 33% from 43%.

It is the same case Cursor made for a team of agents working through the day.

GitHub earned the opening

An analysis by LeadDev counted 257 GitHub incidents between May 2025 and April 2026, 48 of them major. That is roughly one significant disruption a week. GitHub Actions alone accounted for 57 outages in twelve months.

The company has said so itself. Chief technology officer Vlad Fedorov says the platform never anticipated its current scale. An April engineering post conceded GitHub had failed to meet its own reliability standards.

Users have already moved. Zig went to Codeberg in November, and Mitchell Hashimoto announced in April that Ghostty would follow. The Information reported that OpenAI began building its own alternative partly because outages left engineers unable to commit.

GitHub has had no chief executive since Thomas Dohmke resigned a year ago. Microsoft folded the unit into its CoreAI organisation instead. David Uzondu wrote at Neowin that GitHub has not managed a clean month all year.

The question Cursor has not answered

Here is the part that deserves a security review rather than a news cycle.

Cursor Origin reaches all paid plan users from Monday, except enterprise organisations whose administrators opt out. That is opt-out, not opt-in. Plenty of firms have never decided whether proprietary code may sit on a new host. Cursor has now decided for them.

Cursor has published nothing on retention, residency, training use, subprocessors or migration tooling. The documentation covers namespaces, plan gating and privacy mode inheritance, then stops.

Then there is the owner. SpaceX closed the Cursor deal on 14 August, three days before Origin shipped, and Cursor now sits in a division called SpaceXAI.

SpaceX made the takeover official in June at $60bn, and regulators had already asked gun-jumping questions about the two companies working together early.

Jason Andersen of Moor Insights and Strategy put the concern to Tech Times before the deal closed, noting that xAI’s models and its treatment of guardrails differ from what Cursor has stood for.

One company would then control the editor where agents write code, the host where that code lives, and the model those agents run on.

One more thing on the record

Researchers at Mindgard disclosed in July that Cursor would execute a malicious git.exe placed in a Windows project root the moment a user opened it, with no prompt.

They first reported it in December. Cursor declined to patch, calling it out of scope under a shared responsibility model. It conceded it had not closed the loop with the researcher promptly. No CVE exists.

The same flaw class turned up in GitHub Copilot CLI, Gemini CLI and OpenAI Codex, so this is not a Cursor problem alone. It is still an awkward footnote for a product asking to hold your repositories.

What would settle it

Three things, and none of them is the outage.

Confirm your own posture this week, because the default is on. Read the data terms when they exist, and treat Cursor Origin as a convenience layer over GitHub until they do, which is what its architecture already makes it.

Then ask about egress now, while the mirror is still a mirror. Cursor raised its prices last month, and the properties that make Origin safe to adopt are the ones most likely to erode as its incentives shift towards owning the substrate rather than borrowing it.

Get the TNW newsletter

Get the most important tech news in your inbox each week.