AI coding agents have certainly made it easier to transform an idea into a working application. However, getting that application off a local machine and into the hands of real users remains a hurdle, requiring essential infrastructure steps spanning everything from hosting and database provisioning to critical security checks.
Cursor, the AI coding platform acquired by Elon Musk’s SpaceX for $60 billion in August, acknowledged the problem in an X post published on Thursday. “Agents have made it easier to write code, but most apps never make it off localhost,” the company notes. To address this, Cursor is introducing new app-building and deployment functionality designed to take AI-generated applications from development to a live, shareable URL, without users having to think about the underlying infrastructure themselves.
Built on Cloud Agents
The new feature is built around cloud agents, which Cursor introduced last year as a way for developers to run multiple AI coding agents remotely without having to keep their laptops engaged. At the time, the company highlighted their ability to fix bugs, handle smaller coding tasks, and implement complex features. With this latest update, those same agents can now take applications all the way through to deployment, handling the steps needed to make them accessible to other users.
The functionality is only available through cloud agents, meaning it cannot be used with agents running locally.
The workflow follows four steps:
- Prompt Cursor as usual — Users describe the application they want to build in natural language, with Cursor managing code generation and development.
- Cursor’s agent builds the application — The agent creates the application and sets up the underlying project, including the necessary components to get it running.
- Preview the app before publishing — Once the application is ready, users can preview the result before deciding whether to publish.
- Share the app via a live link — Publishing makes the application accessible through a live URL, allowing users to share it with colleagues or other users without configuring hosting themselves.
There are two ways to get started. Users building an application from scratch will automatically have a new repository created on Cursor Origin, the company’s Git-based code-hosting platform launched in August as an agent-centric alternative to GitHub. Alternatively, users can deploy applications from an existing GitHub repository, meaning developers who already have an application under development can use Cursor’s cloud agents to prepare and publish it without moving their code to Origin or setting up deployment infrastructure manually.
Judging by Cursor’s own examples, the feature targets employees who need to create internal business applications such as sales dashboards, onboarding programs, customer presentations, and developer portals. That said, nothing restricts it to business use — an aspiring vibe coder could just as easily create a neighbourhood football league tracker or interactive family holiday planner. Because individual subscribers can publish apps publicly, those creations can be shared with anyone who has the link.
Under the Hood: Hosting, Databases, and Security
Cursor had begun closing this gap in August when it introduced the ability to preview cloud-agent projects and publish them to a live URL — however, users still needed to connect their own Vercel accounts. The latest release removes that requirement while introducing several new capabilities.
Behind the scenes, Cursor now handles hosting, databases, and authentication automatically. For hosting, Cursor creates a dedicated account for each team or individual subscriber, isolated from other customers. While Cursor’s announcement does not identify the underlying hosting provider, Vercel confirmed in a separate X post that the new functionality is built on its Vercel for Platforms infrastructure, allowing users to deploy applications without creating their own Vercel accounts or configuring hosting themselves.
If an application needs a database, Cursor provisions one using PostgreSQL. Private and team applications are protected by Cursor’s existing sign-in system, while individual subscribers can also make their apps publicly accessible. Applications can connect to external services such as company databases or data warehouses, with users supplying the necessary credentials. Cursor says these secrets are managed separately, meaning the AI agent never sees their actual values.
On security, when users choose to publish an application, Cursor runs “a series of deterministic and agentic security checks” before allowing it to go live. These include mandatory checks for exposed credentials, secrets, and sensitive files, alongside an AI-powered review intended to identify more serious vulnerabilities. However, it remains unclear how reliably these automated checks can identify more complex problems, such as incorrectly configured database permissions or application-level access controls — an important consideration for organisations connecting AI-generated applications to sensitive internal systems, where additional security scrutiny remains advisable.
There is precedent for such concerns. In May last year, Semafor reported that two Replit employees examined 1,645 Lovable-built applications and discovered that 170 of them exposed sensitive information due to incorrectly configured database permissions. Lovable subsequently introduced further security checks to identify potential vulnerabilities before applications are published.
Cursor Moves onto Lovable and Replit’s Turf
Cursor is entering territory already occupied by Lovable and Replit, both of which allow users to create and publish applications through natural-language prompts. While Cursor’s latest announcement emphasises internal business tools, Lovable and Replit have traditionally appealed to a broader audience of aspiring application creators. The overlap is clear, and Cursor’s move into deployment has already caught the attention of developers — one software engineer noted on X that “Cursor just came for the localhost graveyard,” riffing on Cursor’s own messaging about AI-generated applications that never make it beyond local development.
There is also an interesting overlap with Grok Build, particularly given SpaceX’s acquisition of Cursor in August. SpaceX AI introduced Grok’s Build Mode in July before expanding it to all Grok plans the following month, allowing users to create apps, games, and websites directly inside a Grok conversation and publish them to shareable grok.me links. That bears a resemblance to Cursor’s latest offering, though Cursor approaches deployment through its established coding environment and cloud agents, with a stronger emphasis on business applications and managed infrastructure. One X user responded to Cursor’s announcement by asking whether Cursor is “now properly replacing Grok Build.” There is no indication that Grok Build is being replaced, but the two offerings now cover notably similar ground, raising questions about how SpaceX AI intends to distinguish them going forward.
Cursor’s new deployment functionality is available on all paid Cursor plans with cloud agents enabled. With deployment increasingly becoming part of the AI coding experience, Cursor’s latest move could put further pressure on dedicated app-building platforms as the distinction between tools aimed at professional developers and those targeting aspiring vibe coders continues to narrow.
