Cursor began rolling out Origin, its own code hosting platform, to paid users on Monday morning. Roughly three and a half hours later, GitHub’s status page lit up red — a six-hour-and-forty-two-minute global degradation with error rates near 20% on pull requests, issues, and the API, and near 50% on archive and raw file downloads. Enterprise single sign-on failed with it: SAML, OIDC, SCIM provisioning, Team Sync. So did Copilot.
Matt Palmer, who works at Cursor, quote-tweeted his own company’s launch with the line that traveled furthest: “We were going to ship this earlier, but GitHub was down.” A GitHub outage delayed the launch of a GitHub competitor. Product launches lock weeks in advance, and nothing suggests Cursor timed this — but the coincidence handed the company an argument it could never have bought.
That argument is worth taking seriously on its own terms, separate from the joke. Building on the SpaceX acquisition of Cursor that closed just four days earlier, Origin is the first concrete answer to what SpaceXAI plans to do with a $60 billion AI coding company beyond selling editor subscriptions: it wants the substrate underneath the editor too.
What Origin Actually Ships#
Origin lives in a new Codebase tab inside the Cursor editor. Teams name a codebase — which becomes part of its URL — then push to it over the command line. From there it’s the machinery you’d expect from a forge: a service layer wrapping Git that handles storage, permissions, checks, and merges. Every repository ships with pull requests — timelines, commits, checks, files changed — reviewable without opening a browser tab.
The more interesting design choice is what runs alongside that machinery. Agents operate in the same surface as the code and pull requests they’re modifying. A developer can ask questions about the file on screen, hand an agent a review comment and have it revise the PR in place, or tell it to push a branch — all inside the editor where the code was written.
Three integrations shipped on day one, and the choices are telling. Vercel spins up a preview deployment for every pull request and ships to production on merge. Depot and Buildkite run continuous integration — critically, both execute existing GitHub Actions workflows unchanged. That compatibility layer is the whole strategy in miniature: Cursor isn’t asking teams to rewrite their build system or rip out their deployment pipeline. It’s asking them to try a second window onto code they already have.
The Smartest Design Choice: GitHub Stays the Source of Truth#
Origin doesn’t ask you to leave GitHub — at least not yet. Connect a GitHub organization, pick repositories, and they appear alongside Origin-native ones. Access permissions mirror GitHub’s existing read and write settings rather than establishing a parallel system. Pushes keep going to GitHub, which stays the source of truth for anything started there. Pull request comments sync in both directions within seconds.
This is a wedge, and a well-executed one. Rip-and-replace migration of source control is one of the highest-risk projects an engineering organization can undertake — it touches CI, compliance evidence, audit trails, branch protection, and every integration in the toolchain. Almost no CTO approves that for an early beta product. A read-mostly mirror that leaves GitHub authoritative approves itself. It costs nothing to try, breaks nothing if abandoned, and quietly relocates where developers spend their working hours. If the review experience proves better, the source of truth eventually follows the attention.
That money went to Graphite, the stacked-pull-request startup Cursor acquired in December 2025 for well above its reported $290 million valuation. Graphite co-founder Tomas Reimers unveiled Origin on stage at Cursor’s first developer conference in June and leads its development. It’s a different bet on the same underlying problem GitHub itself just shipped a fix for: last month’s stacked pull requests going GA on GitHub tried to solve AI-era PR bloat inside the incumbent platform. Cursor’s answer is to own the platform outright.
Agents Write a Third of the Pull Requests Now#
The case for an agent-native forge rests on a claim that’s unusually well supported by evidence: writing code stopped being the constraint, and reviewing and integrating it became one.
Google’s 2025 DORA report, drawn from nearly 5,000 technology professionals, found that 90% of developers now use AI at work, spending a median of two hours a day with it. But AI adoption correlated positively with delivery throughput and negatively with delivery stability — more output, more breakage. Stack Overflow’s 2025 survey of 49,009 developers found trust in AI accuracy falling to 33% from 43% a year earlier, with two-thirds naming “AI solutions that are almost right, but not quite” their leading frustration. GitLab’s DevSecOps survey put a number on the operational drag: 73% of practitioners had hit problems with vibe-coded output.
The volume climbs regardless. GitHub’s own Octoverse 2025 counted 43.2 million pull requests merged per month, up 23% year over year. Cursor’s own internal figure explains why Origin exists at all: 35% of pull requests merged inside Cursor were opened by agents running autonomously in cloud virtual machines, not by people. A forge built for humans assumes a pull request represents human intent — someone you can ask what they meant. Once a third of merged changes come from software, the review queue stops being a conversation and becomes a scheduling problem, which is exactly the shift this site has been tracking as autonomous coding agents move from novelty into daily production workflows.
GitHub Earned This Opening#
The supply-side case for an alternative is simpler: GitHub has been unreliable, and its own executives have said so. An independent analysis counted 257 incidents between May 2025 and April 2026, 48 of them major — roughly one significant disruption a week, with 37 in February alone and GitHub Actions accounting for 57 outages in twelve months. CTO Vlad Fedorov has said the platform “wasn’t built for the scale it’s now being asked to handle.” An April engineering post conceded GitHub had “failed to meet its own reliability standards,” citing rapid growth and tight architectural coupling. Monday’s outage was the seventh incident on GitHub’s status page in fifteen days.
Users have already started leaving. Zig moved to Codeberg in November, citing Actions failures. Mitchell Hashimoto announced in April that Ghostty — a terminal emulator with more than 52,000 stars — would follow, pointing to near-daily outages that blocked reviews and CI for hours. And reporting has suggested OpenAI began building its own GitHub alternative partly for the same reason: outages leaving engineers unable to commit for hours at a stretch.
Who Actually Holds Your Code Now#
Here’s the part that deserves a security review rather than a news cycle. Origin reaches all paid plan users starting Monday — except enterprise organizations whose administrators opt out. That’s opt-out, not opt-in. An organization that never made an affirmative decision about whether proprietary code may be mirrored to a new host has effectively had that decision made for it.
Cursor has published nothing on retention, residency, training use, subprocessors, or migration tooling. And the vendor asking to hold that code just changed hands: SpaceX closed its $60 billion acquisition of Cursor on August 14, three days before Origin shipped, and Cursor now operates inside a division called SpaceXAI. One company would then control the editor where agents write code, the host where that code lives, and — given SpaceX’s frontier-model ambitions post-xAI absorption — potentially the model those agents run on too. That’s a materially different governance question than the one raised by the AI-native editor wars between Cursor and Copilot a year ago, when the stakes were autocomplete quality rather than custody of the repository itself.
There’s also a track record worth weighing before granting Origin repository access. Researchers at Mindgard disclosed in July that Cursor would execute a malicious git.exe planted in a Windows project’s root the moment a user opened it — no prompt required — a flaw first reported in December 2025. Cursor declined to patch it, calling the issue out of scope under a shared-responsibility model while conceding it hadn’t “closed the loop with the researcher in a timely manner.” No CVE was issued. The same flaw class turned up unpatched in GitHub Copilot CLI, Gemini CLI, and OpenAI Codex too — so it isn’t uniquely Cursor’s problem — but it’s an awkward footnote for a product whose entire pitch is “let us hold your repositories.”
What to Settle Before Origin Touches Your Toolchain#
Origin is a beta, not a migration, and evaluated as one it’s a reasonable experiment. Its sync mode gives platform teams a low-risk way to measure whether an agent-native review surface shortens cycle time without touching a single branch protection rule. Three things deserve resolution before anything more authoritative moves:
- The default. Confirm your organization’s enrollment posture this week — the setting is on unless an admin actively opts out.
- The paperwork. Retention, residency, training use, and subprocessor terms are unpublished. Until they exist in writing, treat Origin as a convenience layer over GitHub, not a system of record.
- The exit. Origin’s GitHub-as-source-of-truth design is precisely what makes it safe to adopt today. It’s also the property most likely to erode as Cursor’s incentives shift toward owning the substrate rather than borrowing it. Ask what egress looks like now, while the mirror is still just a mirror.
My Take#
GitHub’s failure and Cursor’s opportunity are different in kind, and it’s worth not confusing them. Monday’s outage resolved in under seven hours — availability is an engineering problem, and engineering problems close, even if GitHub has been closing them badly and often lately. The question of who holds your source code, what they may do with it, and who they ultimately answer to carries no such timestamp.
I don’t think Origin’s technical bet is wrong. Once a third of your merged pull requests come from agents running unattended in cloud VMs, a review surface designed around the assumption that every PR author is a human you can ask a clarifying question to is already the wrong tool. Cursor bought the right company in Graphite, shipped day-one CI and deployment integrations instead of a bare git host, and chose the one architecture — GitHub stays authoritative — that lets a CTO say yes to a pilot without a six-month security review.
What I can’t get past is the sequencing. A company that spent Monday selling trust announced its intent to hold enterprise source code before it published a word about what happens to that code, three days after a rocket company finished buying it, with the mirroring switched on by default. Availability problems earn you a status page apology. Custody problems earn you a subpoena. Cursor has built a genuinely good wedge product. Whether it deserves your repositories is a question its own documentation still refuses to answer.
