When the Rocket Company Wants to Hold Your Code

For nearly two decades, the act of choosing where to store one's source code was widely considered to be the digital equivalent of selecting a brand of cardboard box for one's archival filing. It was a decision of monumental insignificance, usually resolved by defaulting to GitHub, a platform that functioned as a quiet, dignified library where programmers could politely deposit their semicolons and occasionally argue about tabs versus spaces. It was a slow, human affair, conducted with the deliberate pace of a parish council meeting.

This tranquil arrangement was somewhat disrupted recently when Cursor, the darling of the automated code-writing set, rolled out its own code-hosting platform, rather grandly named Origin. In a stroke of timing that would feel heavy-handed in a second-rate satirical novel, GitHub suffered a major global degradation lasting nearly seven hours on the very same morning. The developer internet, which behaves during outages with the calm restraint of a colony of ants whose nest has been disturbed by a lawnmower, immediately began pointing out the irony. A GitHub outage had delayed the launch of a GitHub competitor, because the competitor’s own deployment pipelines were, naturally, hosted on GitHub. It is a delightful loop of modern dependency, akin to a locksmith being unable to open his shop because he left his keys inside.

But the real news lies not in the temporary silence of GitHub’s servers, but in what this new arrangement represents. We are witnessing the quiet transition of the code repository from a dusty archive for human thoughts into a frantic, automated sorting office designed to accommodate fleets of autonomous software agents. According to recent industry figures, some thirty-five percent of the pull requests merged within Cursor are now opened not by humans seeking a cup of tea, but by software agents running in cloud virtual machines.

To the traditional programmer, this is a slightly alarming development. A repository built for humans assumes that a pull request is an expression of human intent—a piece of work you can discuss over a biscuit. When more than a third of your incoming code is being generated by an algorithm that does not sleep, does not require biscuits, and has a tendency to write code that is "almost correct but not quite," the repository ceases to be a library. It becomes a high-velocity scheduling problem. It is the digital equivalent of a post office where the sorting machines have begun writing their own letters to one another, leaving the human postmaster to frantically stamp them as they fly past at terminal velocity.

I once knew a clerk in a municipal planning office who spent three years filing reports that were generated by an automated weather station, only to discover that the station had been reporting the temperature of its own internal cooling fan. He noted, with admirable stoicism, that the filing system had never been more orderly.

To make this state of affairs even more delightfully surreal, the company behind Cursor was recently acquired for the tidy sum of sixty billion dollars by SpaceX, a company primarily known for building very large metal tubes that occasionally explode on their way to the upper atmosphere. Cursor now operates inside a division called SpaceXAI. This means that the software editor you use to write your modest web applications, and the repository where those applications live, are now owned by an organization that answers to a gentleman who is currently preoccupied with colonizing Mars and who is not particularly famous for his adherence to conventional corporate governance.

This introduces a rather novel set of questions for the average chief information security officer. Historically, the security review of a code-hosting platform involved checking SOC 2 compliance and ensuring that the servers were not located in a damp basement. Now, one must evaluate whether one's proprietary business logic is comfortable sharing a home directory with the telemetry data of a Falcon 9 rocket.

Furthermore, Cursor’s new hosting platform operates on an "opt-out" basis for paid users, meaning that unless an administrator actively ticks a box to say otherwise, their code may be mirrored to the new host. It is a lovely example of modern administrative optimism—the assumption that if you do not explicitly object to your property being moved to a different house, you must be perfectly happy for the movers to begin packing the china.

It reminds one of the old parish notices in rural England, which would announce the demolition of a public footpath on a noticeboard hidden behind a particularly dense blackberry bush, on the assumption that anyone who truly cared about the path would have brought their own shears.

There is, of course, a grander philosophical question at play here. As we delegate more of the actual writing of software to automated systems, we are discovering that the bottleneck is no longer the creation of code, but its review and integration. We have built machines that can generate thousands of lines of code in the time it takes a human to find a clean pair of socks, but we have not yet built the machines that can trust them. The result is a strange sort of digital inflation, where the volume of code climbs exponentially while our confidence in its stability plummets.

In this light, the acquisition of a code editor by a rocket company makes a peculiar kind of sense. Both enterprises are engaged in the business of launching highly complex, volatile systems into environments where the slightest error in logic results in a spectacular, and exceedingly expensive, fire. The only difference is that when a rocket fails, it does so in public with a very loud bang. When an automated coding agent fails, it does so quietly, in the middle of the night, leaving a single misplaced decimal point in a pension fund database that will not be discovered until a retired schoolteacher tries to buy a loaf of bread in ten years' time.

Whether organizations will be willing to hand over the keys to their digital kingdoms to a division of SpaceX remains to be seen. For now, the code repository remains a battleground between the old world of human craftsmanship and the new world of algorithmic abundance. And as we watch the automated clerks file their endless paperwork, we can at least take comfort in the fact that if the system does eventually collapse under its own weight, the explosion will be managed by professionals who have a great deal of experience with that sort of thing.