Cursor ($29.3B), Lovable ($6.6B), Replit ($9B): The Vibe-Coding Giants All Rent Their Last Mile
Cursor, Lovable, and Replit raised at a combined $45B on the same promise — spec in, running app out. A side-by-side of what each platform actually runs for the deploy step, and why the runtime underneath is where the next moat gets built.
Your PaaS Thought One Developer Meant One Deploy Queue. Then the Agent Fleet Showed Up.
A third of Cursor's own merged PRs are opened by autonomous cloud agents, and GitHub merged 43.2M PRs a month in 2025. One developer's agent fleet can now exhaust a whole account's daily deploy quota before lunch — here is the burst math and the four pipeline fixes: build queues, preview caps, isolated preview data, and merge triage.
Nine Seconds, Zero Backups: What the PocketOS Wipe Demands From a PaaS That Doesn't Manage Your Database
A Cursor agent deleted PocketOS's production database and every backup in nine seconds. The real failures were architectural: co-located backups and an omnipotent API token. Here is the backup design that survives a rogue agent — and what a PaaS that doesn't manage your database still owes you.
Cursor and Windsurf Can Now Run Your Code in the Cloud. Neither One Can Ship It.
Cursor's Cloud Agents and Windsurf's Devin handoff both run your code in a sandboxed cloud VM and hand back a PR. Here's the documented, vendor-confirmed line where that stops and deploying starts — and what actually closes it.
GhostApproval: The AI Coding Agent Flaw That Turned 'Approve This Edit?' Into a Rubber Stamp
Wiz's GhostApproval disclosure shows six AI coding assistants following symlinks out of their sandboxes while their approval dialogs described a different file than the one being written. Three vendors patched it; two said a patch isn't possible.
9 Seconds to Delete Production: What 93% of AI Agent Incidents Teach About Deploy-From-Chat Guardrails
A 9-second database deletion, a 13-hour AWS outage, and a blown annual budget — five documented 2026 AI agent incidents, the common root cause behind all of them, and the specific guardrails that would have stopped each one.
Your Cursor Sandbox Was Never the Thing Protecting You: Inside DuneSlide's Zero-Click RCE
Two CVSS 9.8 bugs in Cursor let a zero-click prompt injection escape the sandbox and reach full code execution. The real lesson isn't the sandbox bug — it's that the agent held the developer's standing machine permissions the whole time.
Agent System Architectures of GitHub Copilot, Cursor, and Windsurf
An in-depth analysis of the agent system architectures of GitHub Copilot, Cursor, and Windsurf, focusing on their design philosophies, task decomposition, model invocation strategies, and context management to understand their impact on AI-driven programming assistance.