Your security team said no. Proprietary code leaving the network? Non-starter. So your developers kept copy-pasting into ChatGPT like animals, and the CISO pretended not to notice.
On April 2, Anysphere launched Cursor 3 — "a unified workspace for building software with agents." The headline feature: self-hosted background agents that Cursor had shipped the week before. Autonomous AI coding that keeps your code on your servers. This from a company that hit $2B in annual recurring revenue by March 2026, doubling from $1B in roughly four months. Over half the Fortune 500 already uses it.
The architecture checks the compliance box cleanly. A lightweight worker process on your servers connects outbound via HTTPS to Cursor's cloud. No inbound ports, no VPN tunnels, no firewall changes. Code execution, builds, tests, secrets, dependencies — all stay on your infrastructure. Model inference — the actual AI thinking — still hits Cursor's API or whatever LLM endpoint (large language model — the brain behind the AI) you configure. Your code never leaves.
Data residency: solved. Procurement: happy. But here's the problem nobody raised at the procurement meeting.
As the agent works on your codebase, it builds a semantic index — a deep map of your code's structure, relationships, and patterns. Cursor calls it @Codebase. It learns your team's conventions, your architecture decisions, your testing patterns. Over weeks of use, this context compounds into something genuinely valuable: an AI that understands your project.
That understanding lives in Cursor's cloud. And according to a detailed analysis by vexp.dev, it's "not exposed in a way that other tools can consume." No export. No API. No portability standard. The official Cursor docs on self-hosted agents mention data residency seventeen ways but contain zero mentions of context export or memory portability.
The price of switching? vexp.dev estimates that moving to a competitor means the new tool must "re-explore your codebase from scratch — re-reading files, re-discovering relationships, and re-establishing context," which can "double or triple your total token spend." Tokens — the word-chunks AI reads and bills you for — become the hidden migration tax. Three months of accumulated context? Gone. Your new AI starts as a confused intern on day one.
No interchange format exists between Cursor, GitHub Copilot, and Claude Code for agent memory. Some developers hack together shared instruction files (.cursorrules, CLAUDE.md) or bolt on MCP memory servers (Model Context Protocol — think USB but for AI tool connections). These are duct tape, not solutions.
Before your team signs off on Cursor 3 because it checks the self-hosted box, ask one question: what happens to everything the agent learned when we want to leave? The answer, as of today, is that you don't leave. Not because the code is trapped — Cursor solved that — but because the context is.
Data residency was yesterday's lock-in. Agent memory is tomorrow's. Cursor just made the cage more comfortable. Not more open.
