Cursor began rolling out Origin, its own code hosting platform, on Monday morning. About three and a half hours later, GitHub experienced a significant outage. The order of events matters, because much of the online conversation quickly reversed them, implying Cursor had timed its launch to capitalize on GitHub's problems.
A Cursor employee, Matt Palmer, quote-tweeted the company's launch with a joke that travelled further than the product itself. He wrote that Cursor had actually intended to ship earlier, but GitHub was down. It was a humorous aside, but it also highlighted just how pervasive GitHub reliability issues have become.
The outage itself was substantial. GitHub's degradation lasted six hours and forty-two minutes, finally resolving at 20:22 UTC. Error rates reached roughly 20% on pull requests, issues, and the API. Archive and raw file downloads saw error rates of about 50%. Enterprise single sign-on was affected, which meant SAML, OIDC, SCIM provisioning, and Team Sync all failed. Copilot also failed during the incident. According to GitHub's own status page, this was the seventh incident in fifteen days.
What actually broke
The scale of the outage is worth dwelling on. GitHub is the world's largest code hosting platform, and its health directly affects millions of developers and thousands of companies. When pull requests and issues are erroring at a 20% rate, or raw file downloads at 50%, the disruption is not merely an inconvenience. CI/CD pipelines stall, feature releases slip, and developers lose productive hours. Enterprise SSO failures compound the problem by locking users out of their own repositories and authentication flows.
This was not an isolated event. An industry analysis counted 257 GitHub incidents between May 2025 and April 2026, with 48 of them classified as major. That works out to roughly one significant disruption per week. GitHub Actions alone accounted for 57 outages in the same twelve-month period. Even GitHub's own leadership has acknowledged the problem. Chief technology officer Vlad Fedorov has said the platform never anticipated its current scale, and an April engineering post conceded that GitHub had failed to meet its own reliability standards.
The trust erosion has already begun. The Zig programming language project moved to Codeberg in November. Mitchell Hashimoto, creator of Vagrant, announced in April that his Ghostty terminal project would also leave GitHub. And OpenAI, a company that depends on GitHub for its own engineering, has reportedly begun building an alternative because outages left its engineers unable to commit code.
On top of reliability issues, GitHub has been without a chief executive since Thomas Dohmke resigned a year ago. Microsoft folded the unit into its CoreAI organisation, and no permanent leader has been named since. This leadership vacuum has not helped restore confidence.
The wedge is the design
Cursor Origin is a code hosting platform that offers repositories, pull requests, code browsing, and search. But the most interesting decision is what it does not ask for. Cursor does not ask users to leave GitHub. Instead, you connect an organisation, select repositories, and they appear alongside Origin-native ones. Permissions mirror GitHub's existing read and write settings rather than creating a parallel permission system. Pushes continue to go to GitHub, and the changelog says GitHub remains the source of truth for anything started there. Pull request comments sync both ways within seconds.
This compatibility is the entire strategy. Ripping out source control is one of the riskiest projects an engineering team can undertake. Almost no chief technology officer would approve a full migration for an early beta. A read-mostly mirror, by contrast, approves itself. It costs nothing to try, requires no immediate commitment, and quietly relocates where developers spend their day. Once developers are working inside Origin, the path to deeper Cursor adoption becomes much shorter.
Depot and Buildkite can run existing GitHub Actions workflows unchanged, and Vercel handles preview deployments. That means the existing tooling ecosystem continues to function without a disruptive switch. The low-friction approach is designed to make Origin a complement to GitHub, not a replacement, at least for now.
The agent argument is real
Cursor originally announced Origin in June at its first developer conference. It pitched the product as a git forge for the agentic era, where AI agents are increasingly writing and merging code. The demo ran agents at 22.6 commits per second against a single repository, a striking performance metric.
But the supporting number may be even more significant. Industry data suggests that agents running autonomously in cloud machines now open 35% of the pull requests merged inside Cursor. That is a fundamental shift in how code review works. A forge built for humans assumes a pull request carries human intent. You can ask the author what they meant. But once a third of merged changes come from software, the review queue stops being a conversation. It becomes a scheduling problem where humans are just one actor alongside machines.
The broader data supports this strain. Google's 2025 DORA report found that AI adoption tracks positively with delivery throughput but negatively with delivery stability. A survey of 49,009 developers found that trust in AI accuracy is falling to 33% from 43% the previous year. These trends suggest that while AI can accelerate production, it also creates new challenges for reliability and trust.
Cursor has made this exact case: a team of agents can work through the day and night, opening pull requests that humans can review asynchronously. For that to function, the underlying forge must support automation at a level that GitHub, with its decades-old architecture, struggles to match.
GitHub earned the opening
GitHub's reliability record has become a competitive liability. The recent outage was not an anomaly; it was part of a pattern. The platform has been struggling with scale for years, and the increased load from AI coding tools has only made things worse. When GitHub's own CTO admits the platform never anticipated its current scale, it signals a deep architectural problem.
Users have already started voting with their feet. The move of high-profile open source projects like Zig and Ghostty away from GitHub is a warning sign. Even large technology companies are exploring alternatives. OpenAI's effort to build its own source control platform is a particularly telling signal, since OpenAI is one of the most AI-dependent engineering organisations in the world. If its engineers cannot commit code because GitHub is down, the impact on product development is immediate and severe.
The lack of a CEO for over a year adds further uncertainty. Microsoft's decision to absorb GitHub into its CoreAI division may make strategic sense internally, but it has not inspired confidence in the broader developer community. GitHub is no longer an independent company with its own leadership and roadmap; it is a unit within a larger AI push.
The question Cursor has not answered
The outage story dominates the news cycle, but the more consequential story is about Cursor Origin's default behaviour and the missing data terms.
Cursor Origin reaches all paid plan users from Monday, except for enterprise organisations whose administrators explicitly opt out. That is opt-out, not opt-in. Many firms have never decided whether their proprietary code may sit on a new host. Cursor has now decided for them. This is a significant governance issue. When a software tool changes its default behaviour to include a new cloud service, it can silently move data to a location the user never reviewed or approved.
Cursor has published nothing on retention, residency, training use, subprocessors, or migration tooling for Origin. The documentation covers namespaces, plan gating, and privacy mode inheritance, but stops there. This lack of transparency is alarming for a product that will hold source code, which is often a company's most valuable intellectual property.
Then there is the ownership. SpaceX closed the Cursor deal on 14 August, three days before Origin shipped. Cursor now sits in a division called SpaceXAI. SpaceX made the takeover official in June at a valuation of $60 billion. Even before the deal closed, regulators had asked gun-jumping questions about the two companies working together early.
Concerns have been raised about the combination. One industry analyst noted that xAI's models and its treatment of guardrails differ from what Cursor has represented in the past. If one company controls the editor where agents write code, the host where that code lives, and the model those agents run on, that is an unprecedented concentration of power in the AI software development stack.
One more thing on the record
Security researchers also have concerns. A group disclosed in July that Cursor would execute a malicious git.exe placed in a Windows project root the moment a user opened it, with no prompt. The researchers first reported the issue in December, but Cursor declined to patch it, calling it out of scope under a shared responsibility model. Cursor conceded it had not closed the loop with the researcher promptly. No CVE exists for the issue.
The same flaw class has turned up in GitHub Copilot CLI, Gemini CLI, and OpenAI Codex, so this is not a Cursor-specific problem. But it is still an awkward footnote for a product asking to hold your repositories. If Cursor wants to be trusted as a source of truth for code, it must demonstrate that it takes security reports seriously, not just for its AI assistant but for its entire product surface.
The security issue, combined with the missing data terms, creates a picture of a company moving fast to expand its platform while leaving security and governance details behind.
What would settle it
Three things would help settle the uncertainty surrounding Cursor Origin, and none of them is the GitHub outage.
First, confirm your own posture this week. The default is on, so any paid plan user is now affected unless they or their administrator have opted out. That alone is reason to review your organisation's settings immediately.
Second, read the data terms when they exist. Until Cursor publishes clear policies on retention, data residency, training use, and subprocessors, treat Origin as a convenience layer over GitHub. That is what its architecture already makes it, and it is the safest way to use the product in the interim.
Third, ask about egress now, while the mirror is still a mirror. Cursor raised its prices last month, and the properties that make Origin safe to adopt are the ones most likely to erode as its incentives shift towards owning the substrate rather than borrowing it. If Cursor eventually locks users into Origin as a primary repository, moving code out could become difficult or expensive. Egress costs and migration tooling are not trivial concerns. The time to ask is before you become dependent.
Cursor Origin represents a clever and potentially disruptive approach to code hosting, built for an era where AI agents are becoming active participants in software development. GitHub's reliability problems give Cursor an opening, but the lack of transparency around data governance and the potential for lock-in could undermine that promise. The developers and organisations that adopt Origin would be wise to understand exactly what they are opting into before they rely on it as a critical part of their infrastructure.