The loop stays. The workers come home.

Cursor's self-hosted cloud agents are generally available, and the interesting sentence is the one they do not hide. Your worker runs the tools. Cursor still runs the brain.

A worker is a process on a machine you own. It dials out over HTTPS. No inbound ports, no hole in the firewall, no VPN for Cursor to climb through. You type agent worker start, or you stand up a pool with their Helm chart and a Kubernetes operator, or you hang a fleet API off whatever you already run. When someone kicks off an agent, Cursor's harness does the inference and the planning. It sends tool calls down that outbound pipe. The worker edits files, runs the terminal, drives the browser, talks to local MCP servers, hits your caches and the endpoints an engineer would hit. Results go back. The next thought happens in Cursor's cloud. Then the hands move again.

That is the product. Code, secrets, build artifacts, the checkout, the privileged network: those stay. The snippets the model needs to think with (diffs, terminal output, file contents, screenshots) still leave, because that is where the loop lives. Competitors will call that a cop-out. Cursor is calling it the point. They do not want you to maintain a second agent stack. Brex is using it to let agents run the real test suites. Money Forward, a financial-services provider, is wiring nearly 1,000 engineers to open pull requests from Slack. Notion does not want two stacks for a codebase that size.

Enterprise is where the sentence has to get longer.

In the IDE, bring-your-own-key already exists as a client trick. Your OpenAI or Anthropic or Azure or Bedrock key lives on the desktop. The app attaches it to the request. Cursor does not keep it. That is why BYOK does not follow you onto cloud agents, automations, or the phone. Those runs are headless. They keep calling the model after your laptop sleeps. There is no client left to hold the key, and Cursor will not park your provider secret in server state so a worker can keep going for hours. Dean Rie has said this in the forum in as many words. It is a design choice, not a missing checkbox.

Bedrock is the grown-up version of the same problem. On Pro you paste access keys into the IDE. On Teams and Enterprise you can do it properly: an IAM role in the dashboard, an External ID, Cursor's role-assumer in account 289469326074, invoke-only on the models you name. Each user still has to flip Bedrock on in their own client. It arrives off. Enterprise admins can also ban personal BYOK so nobody is quietly routing the company's code through a key they found in a password manager. All of that is the compliance story finance and healthcare actually buy: CloudTrail, VPC endpoints, tokens that never sit in a laptop, models that never leave the AWS account you already filled out a DPIA for.

The gap, if you are the person who has to sign the architecture diagram, is that those two halves do not yet click into one machine. Self-hosted workers give you execution at home. Team Bedrock gives you inference in your account for the IDE. The cloud-agent loop, even when the worker is yours, still plans and infers on Cursor's side, on Cursor's routing, on Cursor's bill for the model. The enterprise picture people sketch on a whiteboard (pool of workers in your VPC, Bedrock-hosted Claude or Titan or Llama, keys that never leave IAM, the Cursor app as the harness your developers already know) is the obvious next weld. It is not what GA is.

What GA is is still a lot. You keep the agent loop in Cursor, which is the thing they are good at: Composer, frontier models, skills, subagents, hooks, the same product whether the VM is theirs or yours. You keep the dangerous bits on your metal. You can start from Slack. You can scale a WorkerDeployment. You can refuse inbound anything. For a lot of teams that is enough to stop building a private coding agent that will be worse and late.

The rest is a sentence the security review will ask, and should. If the thought has to leave the building, whose model is it thinking with, and whose key is paying. Right now the honest answer is: Cursor's, unless you are in the IDE with Bedrock on. The workers came home. The loop did not. That is the deal, and it is clearer than most deals in this market.