![](\"https:\/\/media.thenextweb.com\/2026\/09\/coder-agent-relay-cursor-cloud-agents-self-hosted-dora-article-30.avif\")
<\/p>\nCoder has announced Agent Relay, a self-hosted execution environment that lets Cursor\u2019s cloud agents run inside a customer\u2019s own infrastructure, with SpaceXAI as launch partner and the product in private preview. Cursor continues to run inference and planning, so under the EU\u2019s Digital Operational Resilience Act it remains an ICT third-party provider.<\/p>\n
Coder has announced a way to run Cursor\u2019s cloud agents inside a customer\u2019s own network. SpaceXAI is the launch partner for Agent Relay, the company said<\/a>.<\/p>\n What moves is the execution rather than the model. Cursor keeps running the agent loop, including inference and planning, while tool calls happ<\/a>en on the customer\u2019s machines. Coder calls the result an AI operating layer.<\/p>\n The target market is named plainly. Banks, defence agencies and government institutions, where Coder argues the blocker has always been the deployment model rather than the appetite.<\/p>\n It is in private preview with design partners. There is no pricing, no general<\/a> availability and no named customer anywhere in the announcement. Coder says air-gapped deployment is available where no external access is acceptable.<\/p>\n In Europe that blocker already has a name. DORA has applied<\/a> since 17 January 2025 and governs how financial entities contract for ICT services.<\/p>\n Its requirements do not attach to where code executes. They attach to the arrangement and to the provider behind it.<\/p>\n Which is the awkward part of the pitch. Cursor still runs the inference, so it remains an ICT third-party provider whatever happens to the tool calls.<\/p>\n Article 30 sets out what the contract has to say. Processing and storage locations, audit rights for the bank and its regulator, subcontracting conditions, and data return and deletion on exit.<\/p>\n There is an inventory as well. Article 28<\/a> requires a register linking every provider, service, criticality rating and data location, available to supervisors on request.<\/p>\n Critical functions need a tested way out. Exit plans must cover migration feasibility, notice periods, transition assistance and whether the route has been validated. The bank keeps full responsibility however much it contracts out.<\/p>\n Ownership is a live question here too. SpaceX completed its takeover of Cursor this year.<\/p>\n The point is not that self-hosting is worthless. Keeping source code and secrets on machines a bank controls answers a real objection, and the audit log is a genuine compliance artefact.<\/p>\n It is that the paperwork survives it. TNW reported OpenAI ending model supply to Cursor after the acquisition, which is exactly the dependency Article 30 exists to document.<\/p>\n<\/p><\/div>\n If you liked the article, do not forget to share it with your friends. Follow us on\u00a0Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n If you want to read more like this article, you can visit our Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n\n