Cursor Origin vs GitHub for AI Agents (2026)

The practical guide to code hosting when AI agents, not humans, write most of the pull requests.

On August 17, 2026, GitHub went dark for nearly eight hours with a peak error rate around 20% worldwide, and that same window Cursor flipped on Origin, its own code host built for AI agents. The timing was not subtle, and neither was the message. The company that turned an AI code editor into a $60 billion acquisition now wants to own the layer underneath the editor: the place where code lives, gets reviewed, and gets merged.

Here is the problem the whole industry is circling. Git and the pull request were designed in 2008 for a handful of humans who each opened a few branches a week. In 2026, autonomous agents clone, branch, commit, and open pull requests at machine frequency, and on Cursor's own codebase roughly 35% of merged pull requests are now opened by agents running unattended in cloud sandboxes - DevOps.com. When the author of the code changes from a person typing to a fleet of agents running in parallel, the code host stops being neutral plumbing and becomes the single most important control point in software.

This guide breaks down exactly what Cursor Origin is, what GitHub became with Agent HQ, how the two philosophies differ at the root, what each actually costs, which AI models sit underneath, the wider field of agent-native forges and cloud agents, the security and governance reckoning that agent-authored code has triggered, and where all of this is heading. It assumes no prior knowledge of either platform, starts high level, and then goes deep into the parts that decide real purchasing and architecture choices.

Contents

1. Why code hosting is being rebuilt for agents
2. Cursor Origin, explained: what Anysphere actually shipped
3. GitHub in 2026: from repository host to Agent HQ
4. Head to head: the agent-era code platform scorecard
5. Pricing reality: what Cursor and GitHub actually cost
6. The models under the hood
7. The wider field: rival forges and cloud agents
8. Security, governance, and who owns agent-written code
9. Where each one wins and where each one fails
10. The future: the forge becomes the control plane
11. How to decide

The agent-era code platform scorecard

Before the deep dives, here is the whole field on one scale. This ranks the platforms where you host code and run coding agents, scored on five criteria that matter when agents are the primary contributors. Each cell carries the score and the specific reason for it. The table is sorted by final score, highest first.

Criteria and weights. Agent-Native (25%) measures how well the platform is built for many parallel autonomous agents: agent identity, parallel worktrees, machine-readable review, and infrastructure that survives agent-frequency throughput. Ecosystem (25%) captures install base, integrations, CI, marketplace, and network effects, because a forge is only as useful as everything wired into it. Model & Agent Flexibility (20%) rewards platforms that let you bring or pick multiple agents and models rather than locking you to one vendor. Governance & Security (20%) covers enterprise controls, audit trails, data terms, and provenance. Pricing & Value (10%) is weighted lowest because at this altitude the decision is rarely about the sticker price. The single clearest reading of the table is that GitHub still wins on everything except pure agent-native design, where Cursor Origin and the tiny upstart Entire lead. That tension is the entire story, and the rest of this guide unpacks it.

1. Why code hosting is being rebuilt for agents

Start with the structural question rather than the product question. The product question is "Origin or GitHub?" The structural question is "what does a code host have to become when the majority of commits are authored by software, not people?" Answer that and the product choice becomes obvious. For fifteen years the pull request was a social protocol between humans: one contributor proposed a change, one or two others read it, discussion happened at the pace of a person checking their notifications, and the merge button was pressed once everyone was comfortable. Every affordance of the modern forge, review threads, required approvals, protected branches, merge queues, assumes a human bottleneck on both the writing and the reading side, and that assumption held because writing code was the slow part.

That assumption has now inverted. Writing code is fast and getting faster, while reading and merging it is still gated by humans and by infrastructure built for human volume. The measurable result is a review-and-merge bottleneck that shows up in every serious 2026 dataset. Faros AI's telemetry across roughly 22,000 developers and 4,000 teams found median code review time up 441.5% and code churn up 861%, even as task throughput per developer rose only 33.7% - FlowVerify. The speed went into producing changes, not into absorbing them, and the gap between the two is where delivery now stalls.

The interpretation matters more than the numbers. When code review time climbs by several hundred percent while the amount of code climbs faster, the queue in front of the merge button becomes the binding constraint on shipping software. LinearB, measuring 8.1 million pull requests across 4,800 teams, found AI-assisted pull requests wait 16 or more hours for a reviewer versus roughly 200 minutes for unassisted ones, and their 30-day merge rate collapses to 32.7% from 84.5% - FlowVerify. More code is being produced and less of it is reaching production, which is the opposite of what "AI makes us faster" was supposed to mean. This is why the conversation moved from "which AI writes the best code" to "which platform can absorb code at agent frequency," and why the code host, not the code editor, became the contested ground of 2026.

There is a second structural force underneath the first: parallelism. A human developer holds one to three things in their head at once. An agent fleet does not. Cursor's own co-head of engineering for asynchronous agents describes the shift bluntly: "Instead of having one to three things that you're doing at once, you can have 10 or 20 of these things running" - DevOps.com. Ten or twenty agents on ten or twenty branches turn merge conflicts from an occasional annoyance into a systematic, continuous condition. A serial merge queue with a 30-minute CI run tops out at roughly two pull requests per hour, or 48 per day, which a single team of agents blows past before lunch - TianPan.co. The infrastructure that was "mildly wasteful at human frequency" becomes a denial-of-service at agent frequency.

From these two forces, a clean taxonomy of responses emerges, and every platform in this guide sits in one of three camps. The first camp keeps the forge that hundreds of millions of developers already use and bolts agent orchestration onto it: this is GitHub with Agent HQ and GitLab with its Duo Agent Platform. The second camp argues the forge itself must be rebuilt from the git layer up for agent throughput: this is Cursor Origin, and the provenance-first upstart Entire founded by GitHub's own former CEO. The third camp does not build a forge at all but ships agents that open pull requests against whatever forge you already run: this is OpenAI Codex, Cognition's Devin, Anthropic's Claude Code, and Google's Jules. The strategic fight of 2026 is between the first two camps, because both are trying to own the control plane where humans supervise fleets of machines.

Why this matters in practice is that the two philosophies fail in opposite ways. An incumbent that retrofits agents onto a human-era forge inherits fifteen years of reliability, ecosystem, and enterprise trust, but also inherits infrastructure that its own engineers admit "wasn't built for the scale it's now being asked to handle." A challenger that rebuilds from scratch gets clean agent-native architecture but starts with none of the issues, actions, marketplace, or social graph that make a forge worth using. How to apply this: if your bottleneck is trust, governance, and integration, the incumbent path wins today, and if your bottleneck is raw agent-scale throughput on a greenfield codebase, the challenger path is worth a serious look. The author of this guide, Yuma Heymans (@yumahey), founder and CEO of the AI agent workforce platform O-mega and a co-founder of HeroHunt.ai, spends much of his time running long-running coding agents across parallel workstreams, and the pattern is consistent: the forge, not the model, is where fleets of agents either scale or seize up. We went deeper on that dynamic in our guide to long-running coding agents.

2. Cursor Origin, explained: what Anysphere actually shipped

Cursor is the AI code editor built by Anysphere, the company four MIT students founded in 2022 and grew into one of the fastest-scaling developer tools ever, crossing $1 billion in annualized revenue by late 2025 - The Next Web. Origin is Anysphere's move beyond the editor into the code host itself. Cursor's own framing is deliberately modest in scope and immodest in ambition: "We're starting with the essentials, designed for agent scale: repos, pull requests, code browsing, and GitHub sync" - Cursor. The phrase "agent scale" is the whole thesis. Origin is not pitched as a better GitHub for humans, it is pitched as a code host whose primary users are the fleets of agents that already write a third of Cursor's own code.

The timeline explains the urgency. Origin was first unveiled on June 16, 2026 at Cursor's inaugural Compile conference in San Francisco as a waitlist product slated for the fall, then shipped early in beta to all paid plans on August 17, 2026, months ahead of schedule and squarely in the middle of a historic GitHub outage - DigitalApplied. Between those two dates, SpaceX completed a roughly $60 billion all-stock acquisition of Anysphere, making Cursor a subsidiary of Elon Musk's rocket company and placing it under the same corporate umbrella as xAI - CNBC. We unpack that deal and what it means for developers in our SpaceX buys Cursor breakdown. The keynote where CEO Michael Truell laid out the agent-scale argument is worth watching in full for the reasoning behind the product.

Functionally, Origin ships a focused feature set. You can create repositories, including directly from a Cursor agent, clone and push and pull with standard git, mirror an existing GitHub repository into Origin, open and review and merge pull requests with a full timeline and file diffs, and browse and search code at a URL like cursor.com/codebase/your-name - Cursor. The differentiator is not any single feature but the fact that agents operate inside every repository as first-class users: they can answer questions about the code you are browsing, make changes, update pull requests, and push branches without you leaving the tab. Where GitHub bolts agents on through a subscription, Origin treats the agent as a native inhabitant of the repo, which is a genuinely different starting point even if the visible feature list looks familiar.

The architecture is where "agent scale" stops being a slogan. Origin's stack derives from Graphite, the stacked-pull-request company Cursor acquired in December 2025, re-architected for large volumes of concurrent branches and merge conflicts - BigGo. Secondary technical write-ups describe Origin replacing the three-replica consensus model that classic forges use with a write-ahead log in S3-compatible object storage as the single source of truth, with NVMe as a rebuildable hot cache, so read replicas can scale past a hundred and push throughput rises well beyond what a human-era host targets - explainx.ai. Cursor's own conference demo claimed figures like 22.6 commits per second on a single repository and sub-400-millisecond global sync, numbers that should be read as demo claims rather than independently verified production metrics, but that clearly signal the design target.

The GitHub relationship is the most important thing to understand, because Origin is explicitly not asking you to migrate. Synced repositories update in real time and keep GitHub authoritative: "Pushes keep going to GitHub, which stays the source of truth for anything started there" - Cursor. Pull requests sync both directions, so a comment written in Cursor posts to GitHub, and a reaction or reply on GitHub shows up in Cursor within seconds, and a review assigned on GitHub can be completed and merged from Cursor. Day-one integrations extend that coexistence posture: Vercel spins up a preview deployment for every pull request and ships to production on merge, while Depot and Buildkite run continuous integration and, critically, execute your existing GitHub Actions workflows unchanged. The screenshot below shows those app connections inside an Origin repository.

The honest reading is that Origin in beta is thin, deliberately so. Compared with GitHub it currently lacks issues, wikis, project boards, a marketplace and apps ecosystem, native Actions and CI, packages, webhooks, deployment controls, a social graph, and any on-premise or self-hosting option - Appwrite. An engineer reviewing the beta found that basic repository management still happens largely outside the interface: creating a README, adding or deleting a branch, or editing a file often requires an agent, the Origin command-line tool, or raw git, and the pull-request list is missing affordances as ordinary as open-PR counts and labels. This is not a criticism so much as a description of a beta whose whole point is the hosting layer underneath, not the human-facing chrome on top. For teams evaluating it, Origin is best understood as a second window onto code you already keep on GitHub, not a replacement for it, and that is exactly how Cursor is marketing it. If you want the broader field of Cursor-adjacent tooling, our roundup of Cursor alternatives maps the editor side of the same company.

3. GitHub in 2026: from repository host to Agent HQ

To understand GitHub's answer, you first have to grasp the scale it is defending. GitHub's Octoverse 2025 report counts more than 180 million developers, roughly 630 million repositories, and an average of 43.2 million pull requests merged every month, with a new developer joining "every second" - GitHub. Nearly 80% of new developers use Copilot in their first week, and GitHub's own Copilot coding agent authored more than a million pull requests in its first five months. This is the network effect Cursor Origin is trying to compete with, and it is not a marketing abstraction: it is issues, actions, packages, discussions, security advisories, and fifteen years of open-source identity all wired into one graph. Any challenger forge starts at zero against that, which is why Origin syncs to GitHub rather than trying to replace it.

But scale has been showing cracks, and this is the opening Cursor drove through. An analysis by LeadDev counted 257 incidents between May 2025 and April 2026, 48 of them major, roughly one significant disruption per week, and GitHub's own CTO admitted the platform "wasn't built for the scale it's now being asked to handle" - LeadDev. The August 17, 2026 outage that framed Origin's launch ran nearly eight hours, from 13:28 to 21:15 UTC, with archive and raw-content downloads hitting a 50% error rate and Issues, Pull Requests, Actions, and Copilot all degraded worldwide - The Register. Reliability at agent scale is exactly the pressure point the incumbent is most exposed on, because agents amplify every retry and every failed call into a flood.

GitHub's strategic response is Agent HQ, announced October 28, 2025 at GitHub Universe and moved into public preview through early 2026. The framing is that agents become "native to the GitHub flow" and that GitHub becomes "an open ecosystem that unites every agent on a single platform" - GitHub. The key word is open. Rather than betting that GitHub's own Copilot is the best agent, GitHub is betting that it can be the neutral control plane over everyone else's agents: Anthropic's Claude, OpenAI's Codex, Google's Jules, Cognition's Devin, and xAI's Grok all become invokable inside GitHub as part of a paid Copilot subscription. One enterprise analysis put it sharply, that GitHub is deliberately not competing on agent quality but "building the layer beneath all of them" - Implicator.ai.

The centerpiece is Mission Control, described as "a single command center to assign, steer, and track the work of multiple agents from anywhere," reachable from GitHub.com, VS Code, the GitHub mobile app, and the Copilot CLI - GitHub. Around it sit the pieces that make a fleet governable. Custom agents are defined through source-controlled AGENTS.md files that set rules and guardrails, so a team can encode "prefer this logger" or "use table-driven tests" and have every agent obey. A GitHub MCP Registry lets developers discover and enable Model Context Protocol servers like Stripe, Figma, and Sentry with one click, which matters because MCP is how agents reach the tools and data outside the repo. For readers new to that protocol, our explainer on MCP versus A2A covers why it became the connective tissue of agent tooling.

Two features address the review bottleneck head on. A first-line Copilot code review step is now built into the coding agent's workflow, so Copilot reviews and fixes obvious problems before a human ever sees the pull request, and that review capability, together with its agent skills and MCP connections, reached general availability on July 29, 2026 for all paid Copilot tiers - GitHub. The Copilot coding agent itself is the autonomous worker: you assign it a GitHub issue, it opens a draft pull request, works in a GitHub Actions sandbox, and requests your review when finished. The demo below walks through mission control as the place where all of this is assigned, steered, and tracked.

The governance story is where GitHub's incumbency is hardest to beat, and it is why partner executives lined up behind the launch. An enterprise control plane lets admins set security policies, audit logging, and access management in one place, control which agents are allowed to run, and define which models each agent can reach, with an org-wide metrics dashboard showing agent usage. Anthropic's chief product officer Mike Krieger framed the vision from the agent side: "With Agent HQ, Claude can pick up issues, create branches, commit code, and respond to pull requests, working alongside your team like any other collaborator" - GitHub. GitHub's own chief product officer Mario Rodriguez described the security posture as the differentiator, that the coding agent "has a set of security controls and capabilities that are built natively into the platform, and that's what we're providing to all of these other agents as well" - VentureBeat.

The interpretation is that GitHub and Cursor are optimizing for different customers with the same underlying insight. Both agree the forge is becoming the agent control plane. GitHub is betting that enterprises will pay for neutrality, governance, and the ecosystem they already depend on, and that "any agent, any way you work" beats a single-vendor stack. Cursor is betting that a code host purpose-built for agents will eventually feel as different from GitHub as GitHub felt from a shared network drive. How to apply this today: if your organization runs on Copilot, issues, and Actions, Agent HQ is an incremental switch you can turn on without migrating anything, and that low friction is its single biggest advantage over Origin. If you want the hands-on version of running these agents, our Claude Code beginner's guide and our parallel subagent fleet guide show what agent-driven development actually looks like in practice.

4. Head to head: Cursor Origin vs GitHub Agent HQ

The scorecard at the top ranks the whole field, but the title of this guide is a two-way fight, so this section pits Origin and Agent HQ directly on the dimensions that decide a real choice. The most important thing to say up front is that these two products are not actually the same kind of thing, and pretending they are produces bad decisions. Agent HQ is an orchestration layer on top of the world's largest forge. It does not host your code differently, it changes who can act on the code already hosted there. Origin is a new forge. It changes where the code lives and how the underlying git infrastructure behaves under agent load. One is a control plane over an existing host, the other is a rebuilt host, and that difference cascades into every other comparison.

That framing resolves what would otherwise look like contradictions. Origin wins decisively on agent-native architecture because it was designed for it from the storage layer up, while Agent HQ wins decisively on ecosystem, governance, and model choice because it inherits everything GitHub already is. Neither wins on the other's home turf, and any honest recommendation depends entirely on which axis your bottleneck sits on. The lifecycle of a single agent-authored change makes the contrast concrete, because both platforms run a version of the same loop but optimize different steps of it.

Here is the direct comparison across the dimensions that matter, as a reference before the prose analysis continues. This is a feature comparison, not a scored ranking, so it sits separate from the master scorecard at the top.

The clear-winner statements, dimension by dimension, are these. On raw agent-scale infrastructure, Origin wins, because a write-ahead log in object storage with a hundred-plus read replicas is a genuinely different design than the three-replica consensus model classic forges use, and Cursor built it specifically for the throwaway-repo, high-churn pattern that agent fleets create. On ecosystem and integration, Agent HQ wins and it is not close, because Origin has no issues, no Actions, no marketplace, and no social graph, while Agent HQ sits inside all of them. On model and agent flexibility, Agent HQ wins, because a single Copilot subscription reaches five vendors' agents and more than thirty models, whereas Origin tilts naturally toward Cursor's own Composer and cloud agents. On governance and data custody, Agent HQ wins today, because Origin shipped with no published data or privacy terms while GitHub offers a mature enterprise control plane, a gap section 8 examines in detail.

The uncomfortable synthesis, and the first-principles conclusion this guide will keep returning to, is that the best agent-native architecture and the best place to actually run agents are, in 2026, two different products. Origin has the cleaner engine. Agent HQ has the road, the fuel stations, and the traffic laws. For most teams the road network matters more than the engine right now, which is why the scorecard ranks GitHub first, but the gap on the engine is exactly the kind of gap that compounds if agent volume keeps doubling. A team choosing today is really choosing which bottleneck they would rather live with: the ecosystem gaps of a young forge, or the infrastructure strain of an old one.

5. Pricing reality: what Cursor and GitHub actually cost

Pricing in this category changed shape in 2026, and understanding the shape matters more than memorizing any single number. Both Cursor and GitHub moved from simple seat pricing toward a hybrid of a seat price plus a metered usage pool, because agents consume compute in a way flat subscriptions cannot absorb. On the Cursor side, individual plans run Hobby free, Pro at $20 per month, Pro+ at $60, and Ultra at $200, with Teams at $40 and $120 per user, and each tier includes a pool of third-party model usage ($20 on Pro, $70 on Pro+, $400 on Ultra) that cloud and background agents draw from rather than a fixed hourly rate - Cursor. Origin itself has no separate price: it is bundled into the paid Cursor plans, so if you already pay for Cursor, the code host is included, which is a real advantage over standing up separate hosting.

GitHub restructured more aggressively. On June 1, 2026, it replaced the old premium-request-unit system with usage-based GitHub AI Credits, billed per token at each model's published API rate, on top of a seat price - GitHub. The individual seat prices are Free, Pro at $10, Pro+ at $39, and a new Max tier at $100, with Business at $19 per user and Enterprise at $39 per user. The subtlety that trips people up is that the included credit allowance is now worth more than the seat: the live pricing page lists roughly $15 of monthly credits on Pro, $70 on Pro+, and $200 on Max, which reconciles the apparent gap between the June launch figures and the August pricing page - Automation Atlas. The single most useful cost fact for agent-heavy teams is that the Copilot coding agent consumes exactly one premium request per session regardless of how many files it touches, which lets you delegate far more work inside a fixed allowance than per-message billing would - GitHub.

Here is the side-by-side, with the caveat that metered usage sits on top of every paid tier and can dominate the bill for heavy agent workloads.

The pattern the chart makes visible is convergence. The premium consumer tier has settled at $200 per month across Cursor, OpenAI's Codex, Cognition's Devin, and Anthropic's Claude Code, with GitHub and Replit anchoring a $100 tier below it. That is not a coincidence: it reflects a market that has agreed roughly what a heavy individual user's agent compute is worth, and it means price is no longer the axis that differentiates these products. What differentiates them is what the money buys, which is why the seat-price line matters far less than the metered-usage behavior sitting behind it. A team that runs twenty agents overnight will find the usage pool, not the seat, is the number that determines the invoice. Our breakdown of Claude Code pricing works through exactly how that metered math plays out in practice.

The money behind the products is worth one honest look, because it shapes their trajectories. Cursor's revenue ran from roughly $100 million annualized in January 2025 to $500 million by June to $1 billion by November, a curve steep enough to justify the SpaceX acquisition even before you get to the agent-forge ambition - The Next Web. GitHub does not break out revenue separately since Microsoft folded it into the CoreAI division, with the last official figure a $1 billion ARR disclosed in 2022, so the two are not cleanly comparable on the financials. The chart below shows only the reputably reported Cursor milestones, because the later figures circulating on aggregator sites are not sourced to any primary disclosure and are excluded here.

6. The models under the hood

A code host does not think, the models running inside it do, so a fair comparison has to look at which models each platform reaches and how freely. This is also the part of any AI guide that ages fastest, so every model name here was verified against live sources in August 2026, and the versions that were current even a few months ago are already legacy. As of this writing the flagship coding models are Claude Opus 5 from Anthropic, released July 24, 2026 and recommended in Anthropic's own docs as the default "for complex agentic coding," and GPT-5.6 Sol from OpenAI, which the company calls "our best coding model yet" and which reached general availability July 9, 2026 - Anthropic. Google's flagship is Gemini 3.1 Pro, and xAI's latest is Grok 4.6, released August 12, 2026 for long-running agentic work. If you see Opus 4.8, Sonnet 4.6, GPT-5.4, or Gemini 2.5 named as current anywhere, that source is already out of date.

The reason model choice is a competitive dimension and not a footnote is that no single model wins every task, so the ability to route work to the right one is real leverage. GitHub leans into this hard. The Copilot picker spans more than thirty selectable models across Anthropic, OpenAI, Google, Microsoft's own MAI family, Moonshot AI, and xAI, and Agent HQ extends the same openness to whole agents, letting one subscription reach Claude, Codex, Jules, Grok, and Devin - GitHub. Cursor takes a more curated path. It ships its own in-house model, Composer 2.5, released May 18, 2026 and built for low-latency agentic coding, while still letting you select frontier models from the major labs, and it has teased a from-scratch Composer 3 with around 1.5 trillion parameters trained on SpaceX's Colossus cluster - Cursor. The philosophies mirror the forge fight exactly: GitHub optimizes for neutral breadth, Cursor for a tightly integrated house stack.

Read that chart with a warning attached, because the numbers measure different things. Microsoft's roughly 30% and Google's 30%-plus count AI contribution to all company code across many definitions, Cursor's 35% counts merged pull requests opened autonomously by agents, and the 46% figure is the share of accepted code in files where Copilot is enabled. They are not apples to apples, and stacking them is only useful for the one conclusion they jointly support: at the largest software organizations on earth, a substantial and growing fraction of code no longer originates with a human keystroke. That is the demand-side fact that makes the entire agent-forge race rational rather than speculative. For the deeper model-by-model rankings behind these choices, our best LLM for AI agents ranking scores them on live agent workloads.

There is one cross-ownership wrinkle that only exists because of the SpaceX deal, and it belongs in a models section because it is about who trains what on whose data. After the acquisition, both Cursor and xAI sit under the same parent, so Grok 4.6 is now effectively a sibling product to the forge your code would live on if you used Origin, and Grok was reported to have been trained in part on Cursor developer-workflow data - Kingy AI. Whether that concerns you depends entirely on your threat model, but it is a genuine structural fact that GitHub, whose parent Microsoft has commercial relationships with rather than ownership of the frontier labs, does not carry in the same form. This is the kind of consideration that model routing alone cannot address, and our guide to cutting agent costs with model routing covers the performance and cost side of the same choice, while the custody side belongs to section 8.

7. The wider field: rival forges and cloud agents

Cursor and GitHub are the headline fight, but they sit inside a field that clarifies what each is really betting on. The cleanest way to organize that field is by the taxonomy from section 1, because a tool's category tells you more about its strategy than its feature list does. There are incumbent forges adding agent orchestration, greenfield forges rebuilt for agents, agents that plug into whatever forge you already run, and hybrids that fold hosting and agents into one product. Placing every notable player into that structure turns a confusing list of forty tools into four legible bets about where the value concentrates.

The point of the map is that these categories compete asymmetrically. An agent that plugs into GitHub is not really competing with GitHub, it is feeding it, which is why OpenAI and Anthropic were happy to join Agent HQ rather than fight it. A greenfield forge like Origin is competing with GitHub directly for the hosting layer. And a hybrid like Replit is competing for a different customer entirely, the person who wants to describe an app and have it built and hosted without ever thinking about a forge at all. Reading the diagram with that lens shows why the strategic tension runs along the forge axis specifically.

The incumbent-forge camp is where GitLab matters most. GitLab shipped its Duo Agent Platform to general availability on January 15, 2026, letting agents implement issues, run reviews against organizational standards, and execute multi-step workflows natively inside GitLab, and it introduced GitLab Credits as the usage currency, with Premium seats getting $12 and Ultimate $24 in included credits monthly - GitLab. GitLab's advantage is its DevSecOps heritage: compliance, security review, and audit are native rather than bolted on, which is why it scores second on the master table. Its playbook is identical to GitHub's in shape, turn the existing forge into an agent orchestrator, and different only in that GitLab starts from a security-and-governance position rather than a scale-and-ecosystem one.

The plug-in agents are the busiest and most competitive layer, and they are what most developers actually touch day to day. The biggest are OpenAI Codex, a cloud agent that reads a repo, edits across files, runs tests in a sandbox, and opens a pull request, and Cognition's Devin, billed in Agent Compute Units and now bolstered by the Windsurf IDE Cognition acquired, a company valued around $26 billion by mid-2026 - Value Add VC. Google fields two: Jules, an asynchronous agent that returns a pull request plus an audio changelog, and Antigravity, a full agentic IDE with a manager view for orchestrating parallel agents, which we cover in depth in our Google Antigravity guide. Anthropic's Claude Code rounds out the group as the terminal-native agent bundled into Claude subscriptions.

To keep that layer legible, here are the plug-in agents that matter most and their one distinguishing trait, before the analysis of what they collectively mean.

• OpenAI Codex - cloud agent with the deepest IDE-harness integration
• Cognition Devin - autonomous engineer priced in compute units, now paired with Windsurf
• Anthropic Claude Code - terminal-native, strongest on long agentic coding tasks
• Google Jules - asynchronous, returns a PR and an audio changelog
• Amazon Kiro - spec-driven, writes a requirements-and-design spec before code

What this layer collectively signals is that the agent itself is commoditizing faster than the forge. Five well-funded vendors ship broadly similar "give it a task, get a pull request" products at nearly identical price points, and the differentiation is narrowing to speed, harness quality, and which forge they integrate with best. That commoditization is precisely why the strategic value is migrating down to the hosting and orchestration layer, and why both GitHub and Cursor are fighting there instead of trying to build the single best agent. For a head-to-head on two of these, our Devin versus Claude Code guide goes deep, and the broader top 50 coding-agent frameworks benchmark ranks the full set.

Two smaller players are worth naming because they represent the edges of the design space. Entire, founded by former GitHub CEO Thomas Dohmke with a record $60 million dev-tools seed round, is betting that provenance is the real problem: its open-source Checkpoints CLI stores an agent's prompts, reasoning, and tool calls in git alongside every commit so agent work can be audited and reproduced - TechCrunch. At the opposite edge, self-hosted forges like Gitea and Forgejo remain deliberately human-era with no built-in AI, serving teams that want full sovereignty and are willing to wire agents in themselves. The existence of both edges, hyper-provenance on one side and deliberate simplicity on the other, shows that "agent-native forge" is not a single design but a spectrum of answers to the same pressure.

There is also a layer above the forge that this guide's own vantage point sits in, and it is worth one honest mention as an alternative rather than a detour. Origin and Agent HQ give a developer a control plane for coding agents, but the same structural logic applies one level up to the whole business, where platforms like O-mega run an autonomous workforce of agents across research, browser automation, content, and operations, not only code. It is the same idea, a control plane over fleets of agents, aimed at the company rather than the codebase, and it is mentioned here as one more point on the map, not as the destination. Where the code host absorbs code at agent scale, an agent workforce platform absorbs the surrounding work the code was written to do.

8. Security, governance, and who owns agent-written code

The deepest reason the forge matters is not throughput, it is accountability, and this is where the two philosophies diverge most consequentially. When a human writes a line of code, the forge records who, when, and in which pull request, and that record is the foundation of every audit, incident review, and compliance regime in software. Agents break that foundation quietly, because before 2026 an agent's commits often looked human-authored, and even now most teams cannot cleanly separate the two. GitLab's 2026 AI Accountability Report found 85% of respondents agree AI shifted the bottleneck to reviewing and validating code, 43% say they cannot reliably distinguish AI-generated from human-written code, and 83% believe stronger governance of AI code is needed - InfoQ. The forge is the only place that record can be captured, which is why "who owns this line" is becoming a hosting-layer question rather than a policy-document one.

Trust has not kept pace with adoption, and the gap is the governance problem stated in human terms. The Stack Overflow 2025 survey found 84% of developers now use or plan to use AI tools, up from 76%, and yet only 3.1% highly trust the accuracy of AI output while 45.7% actively distrust it - Stack Overflow. People are shipping code they do not trust, at volume, through review pipelines that cannot keep up, which is a precise description of how governance debt accumulates. The chart makes the mismatch stark.

The supply-chain risk is not theoretical, and 2026 produced the incidents to prove it. In January, security researcher RyotaK reported a prompt-injection chain in Anthropic's claude-code-action rated CVSS 7.8, where a single malicious public GitHub issue could chain an authorization bypass, indirect prompt injection, and environment-variable exfiltration to compromise a repository, and he reported roughly fifty ways to bypass the permission system - The Hacker News. In May, the threat group TeamPCP shipped 84 malicious npm versions across the TanStack packages, the first documented npm attack carrying valid SLSA Build Level 3 provenance, meaning the supply-chain attestation correctly signed a malicious build - StepSecurity. The lesson underneath both is that human-era security assumptions, that provenance implies safety and that permission systems constrain behavior, break when agents author and ship code at machine speed. Our guide to AI agent security and prompt injection defense works through the defensive patterns these incidents demand.

This is exactly the axis where GitHub's incumbency is a moat and Origin's newness is a liability. GitHub's answer is the enterprise control plane described in section 3, plus a first-line Copilot review that catches obvious problems before a human sees them, all built on fifteen years of security tooling. The Code Quality view below is part of that surface, giving reviewers maintainability and reliability signals on agent output.

Origin's posture is the opposite, and it is the single biggest mark against it. The platform shipped with no published data or privacy terms covering retention, training use, subprocessors, or code export, and it is on by default for paid users, so eligible developers' code became hostable on Origin without an explicit opt-in, and enterprise admins have to opt out - The Next Web. Layered on top is the ownership fact from section 6: three days before Origin launched, SpaceX closed its acquisition, so paid developers' hosted code now sits inside the same corporate umbrella that owns xAI. An industry analyst captured the concern directly, questioning whether Cursor under SpaceX would keep routing to Anthropic and OpenAI rather than to Grok, and noting that xAI's approach to guardrails is "very different than what Cursor has stood for" - TechTimes. None of this makes Origin insecure, but it makes Origin unproven on exactly the dimension enterprises weigh most heavily.

The forward-looking answer that both camps are converging on is machine-native provenance, and this is where the newest ideas live. The emerging pattern treats an agent as a first-class non-human identity with its own short-lived, cryptographically attested principal and the delegating human carried separately through per-invocation tokens, so the audit trail survives even when a machine wrote the code - DigitalApplied. Entire's Checkpoints stores the agent's reasoning in git, git worktrees give each parallel agent an isolated workspace, and the EU AI Act's high-risk provisions, effective August 2026, now legally require the human oversight and audit trails that non-human-identity governance provides. How to apply this: whatever forge you pick, the governance question to ask a vendor in 2026 is not "is it secure" but "can you tell me, for any line in production, which agent wrote it, under whose authorization, and why." Our deep dive on securing agents with non-human identity is the practical companion to that question.

9. Where each one wins and where each one fails

Abstract comparisons are useful, but purchasing happens in concrete situations, so this section walks the main scenarios and says plainly which platform wins each and why. The honest meta-point is that there is no universal winner, only a best fit for a given constraint, and the mistake most teams make is choosing on hype rather than on their actual bottleneck. If your bottleneck is trust and integration, the answer differs from a team whose bottleneck is raw agent throughput on a fresh codebase, and pretending one product serves both equally is how AI pilots stall out. We documented that failure pattern in our analysis of why most AI agent pilots never scale, and the through-line is almost always a mismatch between the tool's strength and the team's real constraint.

Consider the shape of the decision before the specifics. GitHub Agent HQ wins wherever the deciding factor is what already exists: an install base, a compliance regime, a CI pipeline, a set of integrations, or an organization that cannot afford to migrate. Cursor Origin wins wherever the deciding factor is what the infrastructure can become: agent-scale throughput, a greenfield or Cursor-centric codebase, and a willingness to trade ecosystem breadth for architectural cleanliness. Everything else is a variation on that axis, and the scenarios below are just that axis applied to specific teams.

Here are the situations that come up most often and the platform that fits each, before the discussion of the edge cases they gloss over.

• Regulated enterprise - GitHub Agent HQ, for the mature control plane and audit trail
• Cursor-native startup, agent-heavy - Cursor Origin, for the integrated agent host it already pays for
• Large existing GitHub org - Agent HQ, because migration cost dwarfs any architectural gain
• Greenfield, throughput-limited team - Origin, worth a serious trial for the agent-scale engine
• Sovereignty or air-gap requirement - neither; a self-hosted forge like Forgejo fits better

The scenarios hide two failure modes worth naming, because they are where confident choices go wrong. The first is choosing Origin for its architecture and then discovering the missing ecosystem daily: no issues to track work, no Actions marketplace, no packages, and repository management that still drops you into the CLI, which for a team that lives in issues and project boards is a constant tax that no amount of agent-scale throughput repays. The second is choosing Agent HQ for its safety and then hitting the reliability wall the outage narrative warned about, because the same infrastructure that gives you fifteen years of ecosystem also gives you a platform its own CTO says was not built for this scale, so at true agent frequency you may find yourself throttled by the incumbent's growing pains.

The way to de-risk both is to test against your real workload rather than a demo, and to measure the thing that actually bites you. If you are evaluating Origin, run a week of your agents' real pull-request volume through it and watch whether the missing chrome slows your humans down more than the fast infrastructure speeds your agents up. If you are evaluating Agent HQ at scale, load-test the agent flows during a busy window and watch the error rates, not the happy path. The benchmarks that matter are your own, and our guide to AI agent evals and benchmarks lays out how to build them so the comparison reflects your workload rather than a vendor's staged one. The wins and failures above are directional; your workload is the only thing that turns them into a decision.

10. The future: the forge becomes the control plane

Step back to first principles for the outlook, because the near-term product race is a symptom of a deeper shift. When intelligence becomes cheap, the scarce thing is not the writing of code but the supervising of the systems that write it, and the forge is the natural place that supervision concentrates. It is where the work is proposed, reviewed, merged, and recorded, which makes it the obvious control plane for a workforce of machines. This is why both the incumbent and the challenger are pouring resources into the hosting layer rather than into building the single best agent: the agent is commoditizing, and the control plane is not. The forge is becoming to agent fleets what the operating system was to applications, the layer everything else has to run through.

The scale of the money involved confirms this is a structural shift and not a fad, which matters because platform bets only pay off if the category keeps growing. Analysts size the AI code-tools market at roughly $6.7 billion in 2024 and $7.4 billion in 2025, growing to somewhere near $26 billion by 2030 at a compound rate around 27% - Grand View Research. Different firms put slightly different numbers on it, but every serious forecast agrees on the direction and the steepness, and a market tripling or quadrupling inside five years is exactly the environment where a control-plane land grab makes sense. When the pie grows that fast, both the incumbent defending its position and the challenger attacking it can win share at the same time, which is why 2026 looks less like a zero-sum war and more like two companies racing to define a category that is still being invented.

That reframing predicts the shape of the next two years better than any feature roadmap. Expect convergence from both directions. GitHub will keep absorbing agent-native ideas into its existing forge, because Agent HQ is already exactly that move, and its distribution means any good idea Origin proves gets copied into a platform 180 million developers already use. Cursor will race to close the ecosystem gap, adding the issues, actions, and governance that a real forge needs, funded by SpaceX's balance sheet and motivated by the knowledge that architecture alone does not beat network effects. The endpoint is not one platform winning but the category as a whole redefining what a code host is: agent identity, machine-readable review, captured provenance, and merge infrastructure built for parallelism become table stakes, not differentiators. Our guide to writing loops for AI coding agents already treats that parallel, provenance-aware workflow as the default rather than the exception.

Pressure-test the two lazy conclusions before landing on the real one. The first lazy take is that GitHub's network effects make it permanent, that Origin is a curiosity. That ignores how quickly agent volume is compounding: if the fraction of code authored by agents keeps climbing, the architecture that handles that load best accrues a structural advantage that ecosystem cannot indefinitely offset, and incumbents who dismissed a cleaner engine have lost before. The second lazy take is that Origin's agent-native design makes GitHub obsolete. That ignores that GitHub is not standing still, that its ecosystem is a fifteen-year moat, and that Origin itself chose to sync to GitHub rather than replace it, an implicit admission of where the code really lives. The nuanced reading is coexistence trending toward convergence, with the forge, whoever wins it, becoming the supervised home of agent fleets.

The pattern does not stop at code, which is the last first-principles point worth making. If the forge is the control plane for coding agents, the same structure appears one level up as the control plane for a business full of agents doing research, outreach, operations, and content, not just commits. That is the bet behind autonomous-workforce platforms like O-mega, and it is the same idea Origin and Agent HQ are proving at the codebase scale, generalized to the company. Whether the unit is a repository or a business, the winning primitive is the same: a place where humans assign, steer, and audit fleets of machines, and where the record of who did what survives the fact that most of the doers are no longer people. The teams thinking about self-improving software are already living in that future at the code layer.

11. How to decide

Reduced to its essence, the decision is not "Origin or GitHub," it is "what is my binding constraint, and which platform relieves it." Everything in this guide has been in service of making that question answerable, so the framework is short. Identify whether your constraint is ecosystem, governance, and migration cost, in which case the incumbent path of GitHub Agent HQ or GitLab's Duo Agent Platform wins, or whether it is raw agent-scale throughput on a codebase you control, in which case Cursor Origin earns a real trial. Then test against your own workload, because the only benchmark that matters is the one that mirrors your pull-request volume, your review pipeline, and your compliance requirements.

A few closing rules make that framework concrete without pretending your situation is generic. If you already run on GitHub and cannot afford disruption, the correct 2026 move is to turn on Agent HQ and treat Origin as something to watch, not adopt, because the migration math almost never favors leaving a working forge. If you are Cursor-native and agent-heavy, Origin is included in what you already pay for, so trialing it costs nothing but attention, and the sync-to-GitHub design means you are not betting the codebase to try it. If governance or data custody is a hard requirement, weigh Origin's absent data terms seriously and do not let architecture elegance override an unanswered custody question. And if none of these fit because you need sovereignty, look past both to a self-hosted forge and wire your own agents in.

The larger truth is that both companies are right about the same thing and wrong about nothing important: the code host is becoming the control plane for fleets of agents, and 2026 is the year that stopped being a prediction and started being a product decision. Choose the platform that relieves your actual bottleneck today, keep watching the one that does not, and expect the two to look far more alike by the end of 2027 than they do now. The winner of this fight will not be whoever has the best agent, it will be whoever builds the best place to supervise a thousand of them.

This guide was written by Yuma Heymans (@yumahey), founder of the AI agent workforce platform O-mega, who spends much of his week running fleets of long-running coding agents in parallel and watching where the forge helps them scale or holds them back.

This guide reflects the AI coding landscape as of August 2026. Both Cursor Origin and GitHub Agent HQ are moving weekly, pricing and model availability change constantly, and specific figures (valuations, model versions, credit allowances) should be re-verified against primary sources before you rely on them.