Coder announced on September 15 that Claude Code now runs inside Agent Relay, its self-hosted execution environment for cloud coding agents. The pitch: regulated-industry customers — banks, healthcare, defense contractors, anyone whose compliance team has opinions about where code execution happens — can run the full Claude Code agent loop on infrastructure they own, while Anthropic continues to handle billing, account administration, and inference. It’s a clean, narrow, well-scoped announcement. It’s also, worth saying up front, not a first for Coder: Agent Relay launched two weeks earlier, on September 2, with Cursor as its debut integration.
That ordering matters more than either company’s press release lets on.
What Agent Relay actually changes#
Agent Relay isn’t a new agent — it’s a deployment boundary. Per Coder’s own announcement, Claude Code agent workspaces now spin up inside customer-owned cloud, VPC, or on-premises infrastructure rather than an external cloud service Coder or Anthropic operates. Each workspace is sandboxed, ephemeral, and scoped to a single session; a Claude Code runner inside it opens outbound connections to Anthropic’s backend for inference, but the filesystem, credentials, and internal service access an agent touches while it works stay inside the customer’s own security perimeter. Network egress policy is set at the environment level and applies uniformly across workspaces. Every workspace provisioning and lifecycle event gets a full audit record.
None of that is exotic architecture — it’s the same “keep execution local, keep inference remote” split that self-hosted runners and enterprise MCP gateways have been converging on all year. What’s notable is who’s asking for it. Anthropic’s Cat Wu, who leads the Claude Code product, put it plainly in the announcement: “The teams that care most about running Claude Code on their own infrastructure tend to be the ones with the most rigorous environmental isolation requirements.” Coder president Josh Epstein was more direct still — regulated industries “have wanted it the most,” and Agent Relay removes the barrier that kept them from adopting agentic coding tools at all.
That’s a real, specific customer segment, not a marketing abstraction: an org that can’t send its source tree to a third-party cloud sandbox, full stop, regardless of how good the agent behind it is. For those teams, “run the agent on infra you already control” isn’t a nice-to-have. It’s the difference between piloting agentic coding and being blocked from starting.
Cursor got there first — and that’s the more interesting fact#
Coder’s own site is unambiguous that Agent Relay shipped September 2 with Cursor as its first supported agent, two weeks before Claude Code joined. If this blog’s job were pure cheerleading, that fact would get buried in a subordinate clause. It shouldn’t be — it’s the more informative half of the story.
Cursor being first here isn’t evidence that Cursor’s architecture is somehow better suited to self-hosted execution. If anything it cuts the other way: Cursor is an IDE-anchored tool built around a human sitting in an editor watching diffs stream in, and that model doesn’t obviously demand the kind of headless, infrastructure-agnostic execution boundary Agent Relay provides. Claude Code, by contrast, has been headless-and-terminal-native by design since it shipped — self-hosted runners, Remote Control sessions, scheduled Routines, CI-triggered execution are all things the product already does well before this integration existed. Structurally, Claude Code was the more natural fit for what Agent Relay offers. It just wasn’t the first to actually ship the integration.
There are a few plausible, unflattering-to-nobody reasons for that gap: Coder may have had an existing relationship or contract that put Cursor first in line; Anthropic’s own enterprise self-hosting story (Bedrock, self-hosted runners, gateway pricing) may have made a third-party self-hosting layer look less urgent internally than it did to Cursor’s team; or it’s simply a function of which company’s engineers Coder talked to first. What it isn’t is proof that Anthropic was slow to recognize the need — the underlying capability (run the agent loop on your own boxes) has existed in Claude Code’s own self-hosted-runner feature for months. This is a second vendor building a second on-ramp to the same destination, not Anthropic playing catch-up on the destination itself.
Why this is still worth writing about#
The regulated-enterprise self-hosting pattern is becoming a real, distinct market segment rather than a one-off request, and it’s worth tracking who serves it and how. Coder’s framing — Anthropic (or any model provider) keeps inference and billing, the customer keeps the execution boundary — is a sensible division of responsibility that should generalize to other agent-plus-infrastructure pairings as the pattern matures. It also quietly validates something this blog has argued since the CLAUDE.md-poisoning and sandbox-escape stories earlier this year: the actual trust boundary that matters for agentic coding isn’t “which vendor’s logo is on the tool,” it’s “who controls the box the agent’s commands actually run on.” Agent Relay is a bet that enough customers care about that second question to pay for infrastructure that answers it directly, independent of which agent sits on top.
Early access is currently limited to design partners, with no public pricing disclosed and no named customer organizations yet — worth revisiting once real deployments, rather than a launch announcement, are the story.
Sources: Coder + Claude Code Agent Relay announcement, Sept 15, 2026 (primary, direct fetch); Coder’s own documentation at coder.com/anthropic for integration details; Agent Relay’s September 2, 2026 Cursor launch confirmed via the same announcement’s background section.