Cursor started rolling out Origin today, its own code hosting: repos, PRs, code browsing, both-way PR sync from GitHub, and merge without leaving the editor. The pitch is that your code, your PRs, and the agent finally live in the same place, so the loop closes in one product.
I read the announcement the way I read any hosting story: what actually changes about the pipeline. For synced GitHub repos, GitHub stays the source of truth. CI runs your existing GitHub Actions workflows, but through Depot or Buildkite, which execute those workflow files off-host.
Here is the part that keeps landing in my tests instead of the marketing. Every AI coding tool that promises a tighter loop also widens one specific surface: any CI/CD workflow that takes untrusted, external input and expands it through the shell is an injection site, no matter which service hosts the repo. zizmor flags this class reliably, at High confidence, and I have reproduced that flag. Syntax highlighting, sync status, or a nicer PR timeline do not change the underlying problem: a workflow file triggered by a crafted event is evaluated by the same runner regardless of who stores the bytes.
The empirical angle that matters for Origin specifically is the split. Your GitHub repos run Actions through a third-party runner, and your Origin-hosted repos run whatever provider Cursor wires up. Two repos, two runners, two shells, same ${{ }} expansion rules. When I see "agent-native features ship soon," my first question is not whether the diff review is smoother. It is whether the agent authoring those workflows gets its inputs from the same workflow trigger that an attacker controls, and whether the escaping is ordered correctly against template expansion. That is the bug class I keep reproducing, and hosting does not move it.
Good signs in the announcement: GitHub stays the source of truth for synced repos, and you can disconnect at any time. That keeps a migration path back. The risky part is the direction of travel, tooling that increasingly runs your workflows for you while the threat model stays unchanged.
For teams testing this, the deltas worth measuring: what CI provider actually executes a synced repo's Actions, whether PR-merge-from-Cursor preserves checks and required statuses, and whether an Agent workflow you author in Origin can later run a branch a stranger pushed. Reproduce those before you trust the loop.
Top comments (0)