GitHub Copilot Cursor and VS Code agents go always-on as OpenAI keeps ZDR

Coding agents left the sidebar this week. GitHub put Copilot’s cloud agent inside Microsoft Teams conversations. Cursor taught always-on agents to wake on PRs and Slack, farm work to isolated VMs, and keep a goal until CI is green. VS Code 1.134 split the agent harness into its own process so the same session can follow you across windows. That is a stack change, not a chat UI refresh: the loop now starts in a meeting, continues in a sandbox, and finishes as a pull request with extra human approval.

The constraint sitting next to that autonomy is data control. OpenAI’s August 19 preview of Private Safety Processing is an explicit bet that longer, multi-turn agent work still has to work with Zero Data Retention — pattern detection without giving lab staff the prompts. For builders, the job this weekend is not “try a new model.” It is to decide where an agent is allowed to wake up, what repo and identity it can write with, and whether your API path still promises that customer content dies after the request.

Top Stories

Cursor cloud agents gain event subscriptions, isolated subagent VMs, and /goal Practical dev impact: You can pin a durable objective (`/goal fix all flaky tests and make CI green`) and let a cloud agent subscribe to the PR it opened until checks and review comments are actually cleared. The August 19 harness update is aimed at always-on agents that pick up work from events instead of waiting for the next human prompt. Subscriptions watch PRs, Slack threads, or a schedule; agents auto-subscribe to PRs they create and keep driving CI fixes and bot comments. Skills can be pinned as custom modes. Subagents now get their own virtual machines and a clean project copy, so a swarm can test or patch in isolation. Follow-ups steer the next tool call instead of killing the current one. Earlier in the week, Origin began an early-beta rollout of Cursor-hosted repos, GitHub sync, and in-product PRs on paid plans.

Visual Studio Code 1.134 adds Agent Host for multi-window Copilot sessions Practical dev impact: The same Copilot agent session can stay alive across VS Code windows because the harness now runs in a dedicated process on the Agent Host Protocol. The August 19 release notes describe Agent Host as the alignment layer with Copilot CLI, the standalone Copilot app, and the Copilot SDK — one behavior, several surfaces. Around that, 1.134 treats long agent work as an editor problem: grid layouts for related chats and subagents, a prompt timeline that jumps to file-changing turns, and Ctrl/Cmd+F across the full transcript including collapsed summaries. If your team already lives in VS Code, this is the week the agent session becomes a first-class workspace object rather than a single-pane chat.

OpenAI previews Private Safety Processing to keep Zero Data Retention on frontier APIs Practical dev impact: Teams that blocked frontier models over retention can stay on ZDR while OpenAI’s automated systems look for misuse patterns across related turns — without giving OpenAI staff the underlying prompts. Existing ZDR evaluates each request in isolation. Private Safety Processing, previewed August 19, is designed for longer agentic tasks where risk only appears across a chain of calls. Content stays on customer-controlled infrastructure, or on OpenAI storage encrypted with customer-held keys. OpenAI says it receives a narrow safety signal, not the text, and is testing with early customers before a September rollout and technical white paper. Treat this as an architecture preview, not a toggle you can flip in production today.

Practical Impact Analysis

Identity and merge policy have to move with that. Copilot’s extra approval for Teams-attributed PRs is the honest version of “human in the loop” — not a veto on thinking, a gate on merge. Cursor agents that auto-subscribe to their own PRs will generate bot-comment churn; your CODEOWNERS, required checks, and sandbox budgets need to assume a machine is the first responder. If Origin is in play, decide now whether GitHub remains source of truth for a repo or whether Cursor-hosted remotes are allowed to grow beside it.

ZDR is the enterprise counterweight. Multi-hour agent traces are exactly the traffic security teams used to refuse to send to a lab. Private Safety Processing is OpenAI arguing it can watch for cross-turn misuse without retaining customer text. Until September’s white paper and rollout, do not assume your current ZDR contract already covers multi-interaction classifiers, customer-key storage, or appeal workflows. If you run mixed vendors, write the data-flow diagram this week: which agent may see production secrets, which path is ZDR, and which kickoff surface (Teams, Slack, IDE) is allowed to mint a write-capable session.

Recommended Tutorial Idea

import os
import time
import httpx

TOKEN = os.environ["GITHUB_TOKEN"]
OWNER, REPO = os.environ["GITHUB_REPOSITORY"].split("/", 1)
REF = os.environ.get("GOAL_REF", "main")
GOAL = os.environ.get("GOAL", "Keep default-branch CI green")

headers = {
    "Authorization": f"Bearer {TOKEN}",
    "Accept": "application/vnd.github+json",
    "X-GitHub-Api-Version": "2022-11-28",
}


... click "Show full code" below to expand

import os
import time
import httpx

TOKEN = os.environ["GITHUB_TOKEN"]
OWNER, REPO = os.environ["GITHUB_REPOSITORY"].split("/", 1)
REF = os.environ.get("GOAL_REF", "main")
GOAL = os.environ.get("GOAL", "Keep default-branch CI green")

headers = {
    "Authorization": f"Bearer {TOKEN}",
    "Accept": "application/vnd.github+json",
    "X-GitHub-Api-Version": "2022-11-28",
}

def latest_run(client: httpx.Client) -> dict | None:
    r = client.get(
        f"https://api.github.com/repos/{OWNER}/{REPO}/actions/runs",
        params={"branch": REF, "per_page": 1},
    )
    r.raise_for_status()
    runs = r.json().get("workflow_runs") or []
    return runs[0] if runs else None

def failed_jobs(client: httpx.Client, run_id: int) -> list[str]:
    r = client.get(
        f"https://api.github.com/repos/{OWNER}/{REPO}/actions/runs/{run_id}/jobs"
    )
    r.raise_for_status()
    return [
        f"{j['name']}: {j['conclusion']}"
        for j in r.json().get("jobs", [])
        if j.get("conclusion") not in (None, "success", "skipped")
    ]

def comment_goal_status(client: httpx.Client, body: str) -> None:
    issues = client.get(
        f"https://api.github.com/repos/{OWNER}/{REPO}/issues",
        params={"state": "open", "labels": "ci-goal", "per_page": 1},
    )
    issues.raise_for_status()
    items = issues.json()
    if not items:
        return
    client.post(items[0]["comments_url"], json={"body": body}).raise_for_status()

with httpx.Client(headers=headers, timeout=30.0) as gh:
    while True:
        run = latest_run(gh)
        if not run:
            print("no workflow runs yet; sleeping")
        elif run["status"] != "completed":
            print(f"run {run['id']} still {run['status']}")
        elif run["conclusion"] == "success":
            comment_goal_status(gh, f"Goal met: `{GOAL}` — run {run['html_url']} is green.")
            break
        else:
            jobs = failed_jobs(gh, run["id"])
            comment_goal_status(
                gh,
                "Goal still open: `{goal}`\nFailed jobs:\n{jobs}\nRun: {url}".format(
                    goal=GOAL, jobs="\n".join(f"- {j}" for j in jobs) or "- (none listed)",
                    url=run["html_url"],
                ),
            )
        time.sleep(60)

Wire that loop to a bot account with `actions:read` and `issues:write` only. Let a human (or the extra Teams Copilot approval) own the merge. That is the production shape of this week’s agents: durable goal, event wake-up, narrow identity, human ship button.

Grok Deep Dive