Cursor launched code hosting on the day GitHub broke for seven hours. Every synced repo still pushes to GitHub

What Cursor shipped, and what it says about it

Cursor announced Origin on its changelog on 17 August 2026, described as early beta on all paid plans, with enterprise organisations able to have their admins opt out. The entry lists what is in it: repositories, pull requests, code browsing and GitHub sync. Agent features are promised rather than shipped.

The interesting sentence is not in the announcement of the feature. It is in the paragraph explaining what happens to a repository you bring across.

Pushes keep going to GitHub, which stays the source of truth for anything started there.

That is a precise statement and it is worth reading twice, because it is the opposite of what a code host launching on the day of a seven hour GitHub outage might be assumed to offer.

Two kinds of repo, one of them still writes to GitHub

Origin early beta · 17 Aug 2026

Created in Origin

Cursor mark in the repo list

Read, browse, search, pull

Origin

Push

Origin

No GitHub in the path. This is the only case where the launch removes a dependency rather than adding a copy of one.

Synced from GitHub

GitHub mark in the repo list

Read, browse, search, pull

Origin copy, updated in real time

Push

GitHub, which stays the source of truth

Browsing and pulling survive a GitHub incident. Pushing does not, because the write path never moved.

On 17 August 2026, GitHub was degraded for seven hours and 36 minutes. A reader with only the right-hand column had a faster place to read their code and the same place to push it.

The sync is a read replica with a two-way comment thread

Origin holds two kinds of repository and treats them differently.

A repository created in Origin is hosted by Cursor. Reads and writes both terminate there, and GitHub is not in the path at all.

A repository synced from GitHub is a copy. Per the changelog, synced repositories "update in real time" and you can "browse, search, and pull from the copy in Origin". Pull request activity is genuinely bidirectional: comment in Cursor and it posts to GitHub, reply on GitHub and it appears in Cursor "within seconds". But the push does not move, and neither does the authority. GitHub stays the source of truth.

So for a synced repository this improves reading and reviewing, and changes nothing about the dependency that failed yesterday. If GitHub is returning errors on 20% of requests, an Origin copy gives you a fast place to read your code and the same broken place to write it.

1GitHub markexcalidraw-test came from GitHub. Reads are served from Origin’s copy. Pushes are not.

2Cursor marktest-repo was created in Origin. This is the only kind of repository with no GitHub in its write path.

3Sync from GitHubThe control that produces the first kind, and the point at which a team acquires a second copy without losing the first dependency.

1. 1GitHub mark excalidraw-test came from GitHub. Reads are served from Origin’s copy. Pushes are not.
2. 2Cursor mark test-repo was created in Origin. This is the only kind of repository with no GitHub in its write path.
3. 3Sync from GitHub The control that produces the first kind, and the point at which a team acquires a second copy without losing the first dependency.

Cursor deserves credit for making this legible. The marks are in the list, the changelog states the behaviour in one plain sentence, and nothing here is hidden. The risk is not that Cursor is misleading anybody. It is that "we have moved off GitHub" is an easy thing for an engineering organisation to believe about itself six months after turning this on, and the interface is the only thing that will contradict it.

The CI escape hatch is GitHub Actions shaped

The app ecosystem points the same way. On continuous integration, the changelog says:

For CI, connect Depot or Buildkite. Both run your existing GitHub Actions workflows and Buildkite also runs its native pipelines.

Compatibility with GitHub Actions workflow syntax is the sensible product decision and the reason anybody can adopt this in an afternoon. It also means the format your build logic is written in remains a format GitHub defines. Buildkite's native pipelines are the one route in the announcement that leaves that behind.

This is a second copy, and a second copy is a governance object

The security reading of this is not about Cursor's engineering. It is about what an early beta does to an estate map.

Syncing a repository creates a second full copy of source code in a second vendor, with its own access model. The changelog is direct about who can see it: "Anyone with read or write access to a synced repo can view it in Cursor too." That is a reasonable default and it is also an access decision that now has two enforcement points rather than one. Repository settings carry sync status, access and connected apps, which is the right place for them, and it is a place most organisations are not yet reviewing.

None of that is an argument against adopting it. It is an argument for knowing it happened, which is harder than it sounds when the feature rolls out to all paid plans by default and the opt-out is available to enterprise administrators rather than applied for them.

The position

The timing is coincidence and should be said plainly. A changelog entry describing an early beta with app integrations, sync, pull requests and a CLI was not built in the seven hours GitHub was degraded on 17 August, and reading it as a response to that incident would be wrong.

What the coincidence does is make the limit legible. Yesterday produced a lot of writing about concentration risk in developer infrastructure, and today there is a product that looks like the answer to it. For repositories created in Origin, it partly is. For the repositories an existing organisation actually has, the ones already on GitHub, it is a faster mirror with better review ergonomics and the same single point of failure underneath, by design and by the vendor's own description.

The useful question is not whether to try Origin. It is whether anybody in your organisation will be able to say, in three months, which repositories Cursor holds and which it merely reflects. The interface answers that with an icon. Nothing else in most estates answers it at all.