Cloud Coding Agents Compared: Where They Run, What They Cost, How They Are Controlled

Cloud coding agents take a task, work on a hosted copy of your repository while you do something else, and hand back a branch or pull request, so the questions that matter are where the code runs, what the agent can reach and who approves the result. This page lines up five asynchronous cloud agents using the same fields for each: Codex cloud from OpenAI, Copilot cloud agent from GitHub, Cursor Cloud Agents, Devin from Cognition and Jules from Google. Every fact comes from the provider's own documentation or pricing page, checked on 2026-11-15. It is for engineering leads, platform teams and security reviewers deciding whether to let an agent work on repositories unattended. Products are listed alphabetically; order is not a ranking and the page gives no verdicts.

Last checked: 2026-11-15.

This is an independent reference page from NHI Mgmt Group based on public provider documentation; it is not sponsored or endorsed by any provider. Cloud agent features and plans change often, so confirm against each provider's current pages.

Key takeaways

• All five run your code on provider infrastructure. Each documents a hosted virtual machine or cloud environment that clones the repository, installs dependencies and runs commands; GitHub and Cursor also offer options that run on infrastructure you control.
• The output is a branch or pull request for a human to review. Copilot cloud agent opens draft pull requests it cannot approve or merge; Codex cloud, Cursor, Devin and Jules return changes for review or a pull request.
• Network defaults differ. Cursor documents internet access on by default with allowlist modes; Copilot cloud agent documents a firewall that can be customised or disabled; Codex cloud documents an internet toggle and allowlists without stating the default on the page checked.
• Secrets are handled differently. Cursor separates environment variables, runtime secrets (redacted from transcripts) and build secrets; Codex cloud offers HTTP secrets tied to allowed domains; Devin's release notes describe secret redaction in transcripts and command output.
• Access is tied to paid tiers. Copilot cloud agent needs a paid Copilot plan, Cursor Cloud Agents need Premium or higher, Teams or Enterprise, Devin has a free tier with a light quota, and Jules has a base tier of 15 tasks a day.

What is a cloud coding agent?

A cloud coding agent is an AI agent that accepts a software task, often from an issue tracker, chat tool or web interface, and completes it asynchronously in a provider-hosted environment, returning code changes rather than suggestions in an editor. The inclusion rule for this page is that the provider's documentation describes the agent running tasks in a cloud environment without the user's machine staying online. The difference between this pattern and an editor assistant is covered in AI Coding Assistants vs Autonomous Coding Agents; the wider tool list is in the AI Coding Tools Hub.

How each provider describes its agent:

• Codex cloud: a way to run Codex coding tasks in the cloud, from investigating bugs to building features, reviewed and continued from the web, mobile or desktop app.
• Copilot cloud agent: "Copilot can research a repository, plan changes, and implement them in the background", in a cloud development environment rather than the local IDE.
• Cursor Cloud Agents: agents that run "in isolated cloud VMs with full development environments"; formerly called Background Agents.
• Devin: "an autonomous AI software engineer that can write, run and test code", with a shell, an embedded IDE and a browser.
• Jules: an "experimental coding agent" that fixes bugs, adds documentation and builds features, working in a virtual machine.

Cloud coding agents at a glance

As of 2026-11-15.

How much do cloud coding agents cost?

As of 2026-11-15. Prices as listed by each provider; usage units differ and are not comparable.

Jules lists Gemini 2.5 Pro for the base tier and access to the latest model, starting with Gemini 3 Pro, for Pro and Ultra. Copilot cloud agent sessions in the GitHub Actions environment have a maximum execution time of 59 minutes that "cannot be extended or bypassed". For list prices across all coding tools, see the AI Coding Tools Pricing Tracker.

Network, secrets and isolation

As of 2026-11-15. This is where the products differ most for security review.

Cursor's statement that cloud agents auto-run commands, and its warning that prompt injection could trick an agent into uploading code, apply in principle to any agent with network access and a shell. See the Prompt Injection Guide and Agent Egress Control and Network Isolation Guide.

Review, attribution and audit controls

• Codex cloud: you inspect changed files, check results and request follow-ups before committing or opening a pull request. Audit features were not stated on the pages checked.
• Copilot cloud agent: only users with write access can trigger it, and comments from users without write access are never shown to the agent. It pushes only to a copilot/ branch or the branch of the pull request it was mentioned on, cannot run git push directly, and cannot mark pull requests ready, approve or merge them. The requester cannot approve the pull request. Commits are authored by Copilot with the requester as co-author, signed and linked to session logs; audit log events are available. Built-in CodeQL, advisory database and secret scanning checks run on its changes.
• Cursor Cloud Agents: commits are signed with an HSM-backed Ed25519 key and show as Verified; on GitHub the agent commits as Cursor Agent with the starter as a Co-authored-by trailer where identifiable. Agents are visible to team members; viewing is read-only unless team follow-ups are enabled.
• Devin: enterprise release notes describe self-serve SSO after DNS domain verification, budgets with sub-budget limits, personal access tokens defaulting to approval required where no policy exists, and a build queue for admins.
• Jules: the plan is approved before code changes; browser notifications report completion or a need for input.

For the security model of each product, see the OpenAI Codex Security Guide, GitHub Copilot Security Guide, Cursor Security Guide and Devin Security.

Data handling and model training

• Codex cloud: not stated on the cloud pages checked; see OpenAI's plan terms and the AI Coding Tools Data Retention and Training Tracker.
• Copilot cloud agent: not stated on the pages checked.
• Cursor Cloud Agents: require Privacy Mode (legacy Privacy Mode not supported); Cursor states it never trains on your code and retains code only to run the agent. Snapshots are encrypted copies of VM disks.
• Devin: not stated on the pages checked.
• Jules: not stated on the documentation pages checked; users must be 18 or older.

How to choose a cloud coding agent: factual criteria

• Code host: GitHub only (Copilot cloud agent, Jules), GitHub plus GitLab (Codex cloud), or four hosts including Azure DevOps and Bitbucket (Cursor). Devin release notes cover GitHub, GitLab and Bitbucket.
• Where execution may happen: if code must not leave your network, look for GitHub's Remote environment, Cursor's Self-Hosted Machines or Devin's VPC deployment, and confirm the details with the provider.
• Egress control: whether admins can enforce an allowlist that users cannot override (documented by Cursor for enterprise) or rely on per-environment settings.
• Merge safeguards: whether the agent can approve or merge its own work (Copilot documents that it cannot) and whether branch protection applies.
• Account type: Jules paid tiers are currently for individual consumer accounts, which matters for organisations that need central billing and SSO.
• Small vs large organisations: a small team can start with a per-user plan and protected branches; a large organisation needs SSO, central policy, audit log export and egress control, which appear on team or enterprise tiers.

Rolling out a cloud coding agent

1. Choose pilot repositories. Start with internal repositories without production secrets or customer data.
2. Install the provider's app with minimum scope. Grant repository access to the pilot repositories only, not "all repositories".
3. Restrict egress. Use allowlist-only or package-manager presets; add domains as tasks need them.
4. Use short-lived secrets. Prefer OIDC or redacted runtime secrets over long-lived keys in environment files or snapshots. See Runtime Secrets Injection for AI Agents Without Prompt Exposure.
5. Enforce branch protection. Require human review and passing checks; keep workflow approval for agent-created pull requests.
6. Measure for four weeks, then widen access by team. Rollback is revoking the app installation and deleting environments, snapshots and stored secrets.

Detection and measurement

• Agent pull request volume and merge rate per repository, by agent identity.
• Review coverage: share of agent pull requests merged with an independent human approval (target 100 percent).
• Egress exceptions: number of allowlist additions and blocked connection attempts per month.
• Secrets findings: secret scanning hits in agent-authored commits.
• Installation scope: count of agent apps with access to all repositories rather than a named set.

Common failure patterns

• Leaving default internet access on. An agent that auto-runs commands with open egress can be steered to send code out.
• Storing secrets in snapshots. Cursor notes that .env.local files in snapshots are saved with them; use the secrets features instead.
• Granting the app every repository. One compromised task then reaches far more code than it needs.
• Auto-running workflows on agent pull requests. This removes GitHub's default approval step and lets agent changes execute in CI.
• Assigning untrusted issues. Issue text is agent input; restrict who can trigger agents, as GitHub does by default for write access.
• Forgetting stored state. Conversation history, VM state and snapshots persist for days or indefinitely; include them in offboarding.

Where identity fits

A cloud agent acts through at least three non-human identities: the code host app installation, the secrets and tokens injected into its environment, and the commit identity it signs with. Each needs an owner, a scope limited to named repositories and a review date, and the human who started the task should remain attributable, as GitHub and Cursor do through co-author trailers. See AI Agent Attribution and Non-Repudiation and the AI Coding Agents Security Guide.

Practitioner checklist

• Confirm which plan tier includes the cloud agent before a pilot, and record the as-of date.
• Limit the code host app installation to named repositories.
• Set network access to allowlist-only or a package manager preset, and lock it where the product allows.
• Put credentials in the product's secrets feature, prefer short-lived tokens, and keep them out of snapshots.
• Require independent human approval and passing checks before any agent pull request merges.
• Keep workflow approval on for agent-created pull requests.
• Restrict who can assign tasks, and treat issue and comment text as untrusted input.
• Export session or audit logs to your SIEM where the product provides them.
• Delete environments, snapshots and conversation history when a pilot or user ends.

Standards and references

• GitHub Docs: About Copilot cloud agent
• GitHub Docs: Risks and mitigations for Copilot cloud agent
• OpenAI: Codex cloud
• OpenAI: Codex cloud environments
• OpenAI: Codex repository README
• Cursor: Cloud Agents
• Cursor: Cloud Agent security and network
• Cognition: Devin documentation
• Cognition: Devin release notes
• Cognition: Devin pricing
• Google: Jules documentation
• Google: Jules usage limits

Related NHI Mgmt Group resources: AI Coding Tools Hub · Open-Source AI Coding Agents · AI Agent Platforms Compared · Vibe Coding Tools Compared