Cursor shipped a cluster of changes to Cloud Agents on 19 August, and read together they describe a shift rather than a feature: from an agent you prompt to an agent you assign.
Three pieces do the work. Subscriptions give an agent a reason to act without being asked. /goal gives it something to keep acting toward. Isolated subagent VMs let it delegate without the delegation stepping on itself.
Subscriptions: acting without a prompt
A subscribed agent wakes on pull request activity, a Slack thread, or a scheduled task, and it acts — no new prompt required. Cursor's framing is direct: agents automatically subscribe to the pull requests they create and drive them to completion, fixing CI and addressing bot comments.
That is the part worth sitting with. Until now, an agent working on your behalf was bounded by a session: you asked, it worked, it stopped, and starting again required you. A subscribed agent has an open-ended commitment to an outcome — "get this PR merged" — and it keeps showing up until that outcome is reached or you tell it to stop.
The feature is available for cloud agents only, for now, which is the correct place to start it. A subscription that fires by itself needs infrastructure to run unattended; a local agent tied to your editor session does not have that by default.
The /goal command
A new /goal command holds a long-lived objective across sessions. Cursor's own pitch example is blunt about the intent: "fix all flaky tests and make CI green."
That is a different kind of instruction from a task. A task has a shape you can picture finishing. A goal like "make CI green" does not have a fixed scope — it could be one flaky test or forty, discovered over days, and the agent is meant to keep working the problem across however many sessions that takes rather than treating each session as the whole assignment.
Subagents on isolated VMs
Subagents now run on isolated virtual machines, each with a clean project copy. Mid-run steering messages queue instead of interrupting the agent in progress.
Isolation is the part that makes delegation safe rather than merely convenient. A subagent working on a clean copy cannot collide with another subagent's changes, and cannot be disrupted by a redirect landing mid-edit — your steering message waits for a safe point instead of arriving as an interruption.
What this changes about your review habits
An agent that only acts when prompted is bounded by your attention: nothing happens you did not start. An agent that wakes on events is bounded by its subscriptions, which is a much larger and less visible set of triggers.
The practical question this raises is not whether the capability is good — it plainly is, for the tedious PR-babysitting most engineers do by hand. It is whether your review process assumes a human initiated every change. If a subscribed agent can push commits to an open pull request in response to a bot comment, at 3am, without anyone re-approving the trigger, that is worth deciding on purpose rather than discovering.
Where this sits in the wider pattern
This is the same direction as everything else shipped this month, taken one step further. Agent Plugins gave agents portable capability. MCP allowlists and the JetBrains managed settings that shipped the same day as this Cursor release give administrators a way to bound what an agent can reach. Subscriptions and /goal give the agent a reason to act without a person in the loop at all.
Capability, portability and now autonomy have each shipped in turn over the past two weeks. Governance is trying to keep pace, and for a feature that fires on events rather than on request, the policy question is no longer just "what can it reach" but "what can wake it up".