Coder introduces Agent Relay in collaboration with SpaceXAI, operating Cursor’s cloud agents on client infrastructure.

      Coder has introduced Agent Relay, a self-hosted execution environment allowing Cursor's cloud agents to operate within a customer's own infrastructure, with SpaceXAI as the launch partner and the product currently in private preview. Cursor continues to manage inference and planning, thereby remaining an ICT third-party provider under the EU's Digital Operational Resilience Act.

      The execution occurs on the customer's network rather than on the model itself. Cursor maintains the agent loop, performing inference and planning, while tool calls are executed on customer machines. Coder refers to this arrangement as an AI operating layer.

      The target market is clearly identified: banks, defense agencies, and government institutions, where Coder contends that the obstacle has traditionally been the deployment model rather than the willingness to adopt the technology. The product is currently in private preview with design partners, and there is no pricing, general availability, or named customers mentioned in the announcement. Coder states that air-gapped deployment is an option for environments where external access is not permitted.

      In Europe, this obstacle has a specific designation. The Digital Operational Resilience Act (DORA) has been in effect since January 17, 2025, governing how financial entities contract for ICT services. Its stipulations are not concerned with where the code runs but rather with the contractual arrangements and the provider involved.

      This creates a complex aspect of the pitch. Since Cursor still handles inference, it remains classified as an ICT third-party provider, regardless of the tool calls' execution.

      Article 30 outlines essential contract requirements, including processing and storage locations, audit rights for the bank and its regulator, conditions for subcontracting, and protocols for data return and deletion upon termination.

      There is also a requirement for inventory. Article 28 mandates a register linking every provider, service, criticality rating, and data location, accessible to supervisors upon request.

      Critical functions necessitate a validated exit strategy. Exit plans must address migration feasibility, notice periods, transition support, and whether the pathway has been validated. Ultimately, the bank retains full responsibility, no matter how much it outsources.

      Ownership presents another important issue, as SpaceX completed its acquisition of Cursor this year.

      The point is not that self-hosting is without value. Retaining source code and sensitive information on bank-controlled machines addresses a legitimate concern, and the audit log serves as a genuine compliance artifact.

      However, the contractual obligations remain in effect. TNW reported that OpenAI ceased model supply to Cursor following the acquisition, which is precisely the dependency that Article 30 aims to document.