Cursor began rolling out Origin, its code hosting platform, to paid users on Monday morning. About three and a half hours later GitHub recorded a global degradation that lasted six hours and forty‑two minutes: GitHub’s incident log showed error rates near 20% across pull requests, issues and the API, and nearly 50% for archive and raw file downloads. Enterprise single sign‑on features (SAML, OIDC, SCIM provisioning and Team Sync) failed during the incident, and Copilot was also affected.
Developers reacted quickly and with irony. Guillermo Rauch, CEO of Vercel, posted on X: “You can now host your repos in Cursor Origin and deploy to Vercel via Cursor Origin which is itself hosted on Vercel. And unlike GitHub, it's online 😁.” Matt Palmer, who works at Cursor, joke‑retweeted his company’s launch saying, “We were going to ship this earlier, but GitHub was down.” In other words, a GitHub outage ended up delaying the launch of a competitor to GitHub.
What Origin is and how it works
Origin appears in a new Codebase tab inside Cursor. Teams name a codebase (which becomes part of its URL) and push to it from the command line. Under the hood, Origin provides the usual forge features: a service layer wrapping Git that handles storage, permissions, checks and merges. Each repository includes pull requests with timelines, commits, checks and changed files; reviewers can read diffs, leave comments and merge without opening a separate browser tab.
The notable addition is that agents now operate in the same surface as the code and the pull requests they modify. The changelog says: “Your code, PRs, and agents are now in the same place.” A developer can ask a question about the file on screen, hand an agent a review comment and have it revise the pull request in place, or tell it to push a branch — all from the editor where the code was written.
Three integrations shipped at launch and the partners chosen are telling. Vercel spins up a preview deployment for every pull request and ships to production on merge (public beta for Pro and Enterprise customers). Depot and Buildkite run continuous integration, and importantly both can execute existing GitHub Actions workflows unchanged; Buildkite also offers native pipelines.
That compatibility layer is the strategy in miniature: Cursor is not asking teams to rewrite their build systems, retrain engineers or replace deployment pipelines. It asks them to try a second window onto the code they already use — a much easier approval ask.
Why leaving GitHub as the source of truth is a smart choice
The design decision enterprises should examine carefully is that Cursor does not require leaving GitHub. Connect a GitHub organization, pick repositories, and they appear alongside Origin‑native ones. The changelog states: “Pushes keep going to GitHub, which stays the source of truth for anything started there.” Access permissions mirror GitHub’s existing read and write settings rather than creating a parallel system. Pull request conversations sync both ways: comment in Cursor and it posts to GitHub; reply or react on GitHub and it surfaces in Cursor “within seconds.”
This is a classic wedge: rip‑and‑replace migrations of source control are among the highest‑risk projects because they touch CI, compliance evidence, audit trails, branch protection, integrations and engineers’ muscle memory. Almost no CTO signs off on that for an early beta product.
A read‑mostly mirror that leaves GitHub authoritative sells itself: it costs nothing to try, breaks nothing if abandoned, and quietly relocates where developers spend their time. If Cursor’s review experience is better — and Cursor paid to ensure it would be — attention could eventually shift the source of truth.
Cursor invested in that review experience by acquiring Graphite in December 2025, a code‑review startup known for stacked pull requests, in a deal Axios said exceeded Graphite’s $290 million Series B valuation. Graphite co‑founder Tomas Reimers unveiled the idea on stage at Cursor’s Compile conference in June and leads Origin’s development.
How AI agents made code review the new bottleneck
Cursor’s argument for an agent‑native forge rests on an observation backed by evidence: writing code is no longer the main constraint; reviewing and integrating it is. Google’s 2025 DORA report, based on nearly 5,000 technology professionals, found that 90% of developers use AI at work, spending a median of two hours per day with it, and more than 80% say it made them more productive. However, AI adoption correlated with higher delivery throughput and lower delivery stability — more output and more breakage.
Trust hasn’t kept pace. Stack Overflow’s 2025 developer survey (49,009 respondents) found 84% using or planning to use AI tools, while trust in their accuracy fell from 43% to 33% year over year and distrust rose from 31% to 46%. Two‑thirds cited “AI solutions that are almost right, but not quite” as a main frustration. GitLab’s ninth annual DevSecOps survey (3,266 practitioners) reported operational drag: 73% had problems with vibe‑coded output, 70% said AI made compliance harder, and only 37% would let AI handle daily tasks without human review.
Volume keeps growing. GitHub’s Octoverse 2025 counted 180 million developers, 630 million repositories and 43.2 million pull requests merged per month (up 23% year over year). RuntimeWire reported an internal figure that helps explain Origin’s existence: 35% of pull requests merged inside Cursor were opened by agents running autonomously in cloud VMs.
A forge designed for humans presumes a PR expresses human intent opened by someone you can ask. When a third of merged changes come from software, the queue stops being a conversation and becomes a scheduling problem — a strong architectural argument in Cursor’s favor.
GitHub’s reliability issues opened a door for Cursor
The supply‑side case for an alternative is straightforward: GitHub has been unreliable, and its own executives have acknowledged problems. An analysis by LeadDev counted 257 incidents between May 2025 and April 2026, 48 of them major — roughly one significant disruption per week. February was the worst month with 37 incidents. GitHub Actions alone accounted for 57 outages in twelve months. CTO Vlad Fedorov said the platform “wasn't built for the scale it's now being asked to handle” and must plan for up to 30x today’s load. In an April engineering post covered by InfoQ, the company admitted it “failed to meet its own reliability standards,” citing rapid growth, tight coupling and inadequate load shedding. Monday’s outage was the seventh incident on GitHub’s status page in fifteen days.
Some defections predate Origin. The Zig programming language moved to Codeberg in November 2025 citing Actions failures; in April Mitchell Hashimoto announced Ghostty would leave GitHub after near‑daily outages blocked reviews and CI for hours; The Information reported in March that OpenAI began building its own GitHub alternative partly because outages left engineers unable to commit for hours.
Microsoft’s organizational changes have not helped. Thomas Dohmke resigned as GitHub CEO in August 2025 and the unit’s leadership moved under Microsoft’s CoreAI organization led by EVP Jay Parikh. The Information reported Parikh warned deputies that coding tools from Cursor and Anthropic could eventually make GitHub obsolete. GitHub’s own agent‑era answer, Agent HQ, orchestrates third‑party agents (Anthropic, OpenAI, Google, Cognition, xAI) inside GitHub — a strategy that concedes the agent layer while keeping the substrate. Origin targets that substrate directly.
Ownership and governance questions after SpaceX’s acquisition
Cursor’s rise has been rapid. Founded in 2022 by four MIT students, the company raised $8 million from the OpenAI Startup Fund in October 2023 (TechCrunch), then raised larger rounds at $2.5 billion, $9.9 billion and $29.3 billion valuations, and Bloomberg reported in May annualized revenue of $3 billion and more than 3,000 customers paying at least $100,000 a year.
Three days before Origin shipped Bloomberg reported that SpaceX completed a $60 billion all‑stock acquisition of Cursor. Cursor now operates inside a division called SpaceXAI. That development raises governance questions: when the same company controls the editor where agents write code, the host where code lives and the models those agents run on, what governs how the code is used?
Cursor has not published answers. RuntimeWire noted before launch that Origin’s pricing, security architecture, data‑handling terms and migration tooling were unpublished, and the Monday changelog offers no new contractual detail. It states only that Origin reaches “all paid plan users starting today, except enterprise orgs whose admins opt out.” Opt‑out, not opt‑in — a detail enterprise admins should note.
There is also a prior security concern: in July Mindgard researchers disclosed that Cursor would execute a malicious git.exe placed in a Windows project root the moment a user opened it, without prompting — a repository‑poisoning flaw they first reported in December 2025. The Hacker News reported Cursor declined to patch it citing a shared‑responsibility model and admitted it had not closed the loop with the researcher in a timely manner. No CVE was issued. Similar flaw classes appeared in GitHub Copilot CLI, Google’s Gemini CLI and OpenAI’s Codex — but a vendor declining to fix a vulnerability is an awkward footnote for a product pitching itself to hold customers’ repositories.
What engineering leaders should settle before adopting Origin
Origin is a beta, not a migration, and evaluated as such it can be useful. The sync mode gives platform teams a low‑risk way to measure whether an agent‑native review surface shortens cycle time without changing branch protection rules. But three issues deserve resolution before moving anything authoritative:
-
Default behavior: Origin turns on for paid users unless an enterprise administrator opts out. That means organizations that haven’t made an affirmative choice about mirroring proprietary code to a new host effectively have that decision made for them. This is a Monday‑morning item, not a next‑quarter one.
-
Paperwork and terms: retention, residency, training use, subprocessors and what changes now that Cursor reports into SpaceX are not published. A product page is not a contract; until written terms exist, treat Origin as a convenience layer over GitHub rather than a system of record — which matches its current architecture.
-
Exit/egress: Origin’s Actions compatibility and GitHub‑as‑source‑of‑truth design are the properties that make adopting it safe. They are also the aspects most likely to erode if Cursor shifts incentives toward owning the substrate. Ask what egress looks like now, while the mirror is still a mirror.
None of this makes Cursor’s argument invalid. GitHub became the incumbent by being dependable; over the past eighteen months it has not been. Origin is a serious response to a real problem, built by a team that acquired the right technology to build it. But availability outages and questions about who holds and controls source code are different in kind. Availability is an engineering problem with a timestamp; ownership, use and governance are not — and on those questions Cursor, which spent Monday selling trust, has not yet published its terms.
The Monday outage resolved at 20:22 UTC.
