Coder introduces Agent Relay alongside SpaceXAI, operating Cursor’s cloud agents on client infrastructure.

      Coder has introduced Agent Relay, a self-hosted execution environment that enables Cursor’s cloud agents to operate within a customer’s infrastructure, with SpaceXAI as the launch partner and the product currently in private preview. Cursor continues to manage inference and planning, thereby maintaining its status as an ICT third-party provider under the EU’s Digital Operational Resilience Act.

      The execution is managed rather than the model itself. Cursor remains responsible for the agent loop, including inference and planning, while tool calls take place on the customer's systems. Coder refers to the outcome as an AI operating layer.

      The target market is explicitly identified as banks, defense agencies, and government bodies, where Coder asserts that the obstacle has always been the deployment model, rather than interest in the product itself.

      Currently, it is in private preview with design partners, and there are no details on pricing or general availability, nor any disclosed customers in the announcement. Coder mentions the availability of air-gapped deployment where external access is not permitted.

      In Europe, the obstacle has a specific name: DORA, which has been in effect since January 17, 2025, regulating how financial entities procure ICT services.

      Its stipulations are not dependent on where the code runs, but rather on the contractual arrangement and the provider's responsibilities.

      This presents a challenging aspect of the proposal, as Cursor continues to handle inference, thus remaining an ICT third-party provider regardless of the tool calls being made.

      Article 30 outlines the necessary contract provisions, including processing and storage sites, audit rights for both the bank and its regulator, conditions for subcontracting, and requirements for data return and deletion upon exit.

      There is also an inventory requirement. Article 28 mandates a registry that connects every provider, service, criticality rating, and data location, accessible to supervisors upon request.

      Critical functions necessitate a validated exit strategy. Exit plans must address migration feasibility, notice periods, transition assistance, and the validation of the exit route, while the bank retains complete responsibility, regardless of how much it outsources.

      Ownership is also a significant discussion point in this context, as SpaceX successfully completed its acquisition of Cursor this year.

      The key takeaway is not that self-hosting lacks value; keeping source code and sensitive information on a bank's own machines addresses a legitimate concern, and the audit log serves as a valid compliance artifact.

      However, the related documentation remains crucial. TNW reported that OpenAI ceased model provision to Cursor following the acquisition, which is precisely the dependency that Article 30 aims to clarify.