The Accidental Perfect Launch

Timing, they say, is everything. Cursor launched Origin, its code hosting platform, on August 17, 2026.

The platform brings repositories, pull requests, reviews, merges, and CI connections directly into Cursor — putting the company into territory long dominated by GitHub. Roughly three and a half hours after rollout began, GitHub's status page lit up with what became a six-hour-and-forty-two-minute global degradation. Error rates hit nearly 20% across pull requests, issues, and the API, and approached 50% on archive and raw file downloads. Enterprise SSO — SAML, OIDC, SCIM provisioning, Team Sync — collapsed entirely. So did Copilot.

The developer internet reacted immediately. Vercel CEO Guillermo Rauch posted on X that Origin was "unlike GitHub" in one key respect: it was online. He later clarified he was trying to make light of a situation that had also broken Vercel's own workflows. Matt Palmer of Cursor offered the day's sharpest line: "We were going to ship this earlier, but GitHub was down." A GitHub outage, in other words, delayed the launch of a GitHub competitor — with no evidence Cursor timed it that way.

The coincidence was enormous free marketing, but it also crystallized the argument Origin exists to make. For eighteen years, choosing where to host your team's source code has been the least interesting decision an engineering organization makes. Cursor is betting that AI agents have made it interesting again — and for technical decision-makers, that is the real news here. Not a new product, but a new procurement question with a governance problem attached.

What Origin Actually Does

Origin lives inside Cursor under a new Codebase tab. Teams name a codebase, which becomes part of its URL, then push to it over the command line. Under the hood, they get the service layer that wraps Git and handles storage, permissions, checks, and merges.

Every repository ships with pull request tooling: timelines, commit views, diff inspection, inline commenting, and merge — all inside the editor. Crucially, agents operate on the same surface as the code and PRs they're touching. A developer can hand a review comment to an agent and have it revise the pull request in place, without switching context. "Your code, PRs, and agents are now in the same place," the changelog reads.

Three integrations launched on day one:

  • Vercel — spins up a preview deployment for every pull request and ships to production on merge (public beta for Pro and Enterprise)
  • Depot and Buildkite — run CI; both execute existing GitHub Actions workflows unchanged, with Buildkite adding native pipelines on top

That compatibility layer is the whole strategy in miniature. Cursor is not asking teams to rewrite their build system, retrain their engineers, or rip out their deployment pipeline. It is asking them to try a second window onto code they already have — which is a far easier request to approve. A forge without deployments and CI is a code viewer. A forge that runs your existing Actions workflows and ships previews to the CDN you already pay for is a candidate.

The Wedge Strategy: Leave GitHub as Source of Truth

Here is the design choice enterprise buyers should study most carefully, because it determines whether Origin survives a security review at all.

Cursor does not ask you to leave GitHub. Connect a GitHub organization, pick repositories, and they appear alongside Origin-native ones. Pushes keep going to GitHub, which stays the source of truth for anything started there. Access permissions mirror GitHub's existing read/write settings rather than establishing a parallel system. Pull request conversations sync bidirectionally — comment in Cursor and it posts to GitHub; reply on GitHub and it surfaces in Cursor within seconds.

This is a classic wedge, and a well-executed one. Rip-and-replace migration of source control ranks among the highest-risk projects an engineering organization can undertake — it touches CI, compliance evidence, audit trails, branch protection rules, every integration in the toolchain, and the muscle memory of every engineer on staff. Almost no CTO approves that for a product in early beta.

A read-mostly mirror that leaves GitHub authoritative costs nothing to try, breaks nothing if abandoned, and quietly relocates the place developers spend their working hours. If Cursor's review experience proves better, the source of truth eventually follows the attention.

The Graphite Foundation

The money that made Origin credible went to Graphite, the code review startup Cursor bought in December 2025 for what Axios reported was well above its $290 million Series B valuation. Graphite built stacked pull requests — the workflow that lets developers keep shipping dependent changes without waiting on approvals. Announcing the deal, Cursor wrote that "the boundary between where you write code and where you collaborate on it feels increasingly arbitrary."

Origin is the radical idea that promise gestured at. Graphite co-founder Tomas Reimers unveiled it on stage at Cursor's inaugural Compile conference in June and leads its development.

Why the Bottleneck Shifted to Review

The case for an agent-native forge rests on a claim that is easy to state and, unusually for this market, well supported by evidence: writing code stopped being the constraint. Reviewing and integrating it became one.

The data behind that claim is stark:

  • Google's 2025 DORA report, drawn from nearly 5,000 technology professionals, found 90% of developers use AI at work, spending a median of two hours a day with it — but AI adoption showed a positive relationship with throughput and a negative one with delivery stability. More output, more breakage.
  • Stack Overflow's 2025 developer survey of 49,009 respondents found 84% using or planning to use AI tools, while trust in their accuracy fell to 33% from 43% year-over-year, with distrust climbing to 46% from 31%.
  • GitLab's ninth annual DevSecOps survey found 73% had hit problems with vibe-coded output, and only 37% would let AI handle daily tasks without human review.
  • RuntimeWire reported the internal figure that best explains Origin's existence: 35% of pull requests merged inside Cursor were opened by agents running autonomously in cloud VMs. A forge built for humans assumes a pull request represents human intent. Once a third of merged changes come from software, the queue stops being a conversation and becomes a scheduling problem.

Cursor's own security agents are reportedly reviewing more than 3,000 pull requests each week — a number that makes the architectural argument concrete rather than hypothetical. GitHub was built for human-scale development. Origin is built around the assumption that large numbers of AI agents will be cloning, branching, committing, rebasing, reviewing, and fixing failures in parallel — a fundamentally different load profile.

What's Still Unresolved

Pricing, security architecture, data-handling terms, and migration tooling were all unpublished before launch — and Monday's changelog added none of them.

There is also a broader governance question looming over the entire stack. When one company controls the editor where agents write code, the host where that code lives, and the model those agents run on, what governs what it does with that code? Cursor has not published an answer. That question grows heavier given that researchers at Mindgard disclosed in July that Cursor would execute a malicious git.exe planted in a Windows project's root the moment a user opened it, with no prompt — a repository-poisoning flaw first reported in December 2025.

For startup founders and technical decision-makers, Origin is not just a new product to evaluate — it is a new procurement question with a security review attached. The wedge strategy makes adoption easy. Whether it survives a CISO conversation depends entirely on documentation Cursor has yet to publish.