Cloud Agent secrets not injected — CLOUD_AGENT_* / ATLASSIAN_* absent (Automation + manual)

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cloud Agent (GitHub, Slack, Web, Linear)

Describe the Bug

Personal Runtime secrets (All Repositories) are configured correctly, but Cloud Agent VMs never receive them. Marker env vars CLOUD_AGENT_INJECTED_SECRET_NAMES / CLOUD_AGENT_ALL_SECRET_NAMES are completely absent, and all ATLASSIAN_* secrets are ABSENT. This happens on Automation-triggered runs and also on a manual Cloud Agent diagnostic on the same repo.

Steps to Reproduce

In Cursor Dashboard → Cloud Agents → Secrets, create Personal Runtime secrets (scope All Repositories):
ATLASSIAN_BASIC_AUTH_USERNAME
ATLASSIAN_BASIC_AUTH_TOKEN_ONCALL (and/or ATLASSIAN_BASIC_AUTH_TOKEN)
Create/use a Private Automation on quintoandar/qa-hub (branch cursor/bugs-incident-agent) that runs a Cloud Agent and reads those env vars.
Trigger the Automation (Jira webhook) or launch a manual Cloud Agent on the same repo/branch with this diagnostic prompt:
echo “CLOUD_AGENT_INJECTED_SECRET_NAMES=${CLOUD_AGENT_INJECTED_SECRET_NAMES:-ABSENT}”
echo “CLOUD_AGENT_ALL_SECRET_NAMES=${CLOUD_AGENT_ALL_SECRET_NAMES:-ABSENT}”
for v in ATLASSIAN_BASIC_AUTH_USERNAME ATLASSIAN_BASIC_AUTH_TOKEN_ONCALL ATLASSIAN_BASIC_AUTH_TOKEN; do
if [ -n “$(printenv “$v” 2>/dev/null)” ]; then echo “$v=SET”; else echo “$v=ABSENT”; fi
done
Inspect the shell output (presence only; do not print secret values).

Expected Behavior

Runtime secrets are injected into the Cloud Agent VM as normal environment variables.
CLOUD_AGENT_INJECTED_SECRET_NAMES / CLOUD_AGENT_ALL_SECRET_NAMES list the configured secret names.
ATLASSIAN_BASIC_AUTH_USERNAME and token vars are present (SET when checking [ -n “$VAR” ]). Value redaction in transcripts is fine; presence should still be true.

Operating System

MacOS

Version Information

3.13.25
31e8d61c448c7472e371505838a0fe34083dad50
arm64

For AI issues: which model did you use?

Fable 5 high

For AI issues: add Request ID with privacy disabled

{
“bcId”: “bc-9e67c5d3-2499-4cd6-9eee-8b5d93c4b544”,
“url”: “https://cursor.com/agents/bc-9e67c5d3-2499-4cd6-9eee-8b5d93c4b544”,
“name”: “Bugs incident triage”,
“source”: “automations”,
“automationId”: “47d79f6a-89ce-11f1-b532-320a589b8025”,
“model”: “claude-fable-5-thinking-high”,
“createdAt”: “2026-07-28T19:36:58Z (UTC)”
}

Does this stop you from using Cursor

No - Cursor works, but with this issue

6

Hey there!

Take a look at your automation’s environment settings. When an automation is configured to skip the cloud environment (the option labeled something like “No Environment” or the fast-start / skip-install toggle in the automation editor), runtime secrets aren’t injected into the VM. That matches exactly what you’re seeing: the marker env vars are entirely absent, not just empty, because the injection step doesn’t run in that mode.

Try turning that toggle off so the automation uses your configured cloud environment, then re-run — your Atlassian secrets should be present. You can sanity-check by comparing against any of your other automations on the same team that are getting secrets correctly; you’ll see they’re not set to skip the environment.

One quick note on the “manual Cloud Agent” run you tested: the bcId you shared (bc-9e67c5d3-...) is actually an automation-source run — you can see it in the JSON you pasted ("source": "automations"). If you want to verify a genuinely manual case, launch a Cloud Agent directly from cursor.com/agents (the “New Agent” button on the web) on the same repo/branch, and Personal-scope + All-Repositories secrets should inject there regardless of the automation config.

If turning off the skip-environment option doesn’t resolve it, or you’re launching a genuinely web-manual run and still seeing secrets absent, reply with the new bcId (with privacy disabled, ideally) and I’ll dig in further. We do agree that the UI could be clearer here - I’ll flag the missing warning on the automation editor internally.

7

Thanks — I looked again at the automation editor and I cannot find any control matching your description.

Automation: BUGS — Incident Triage (Private)
URL: https://cursor.com/t/grpqa/automations/09ca44ab-8540-11f1-a7d1-d6b4613131ce
Repo/branch: quintoandar/qa-hub · cursor/bugs-incident-agent

On the Settings tab I only see:

  • Header: repo + branch dropdowns, “Cloud” compute selector (with “Self-hosted Pools”), “By LUANA SILVA”, Members menu
  • Triggers (webhook + Generate auth header)
  • Agent Instructions
  • Model selector (Fable 5 High)
  • Tools (partial: Open Pull Request, Memories)

There is NO:

  • “No Environment” option
  • “Use Configured Environment” toggle
  • Environment dropdown (e.g. qa-hub)
  • Repositories section with single-repo vs multi-repo environment
  • Any skip-environment / fast-start / skip-install toggle

Screenshot attached showing exactly what my editor displays.

Secrets are Personal scope, All Repositories:
CHAPTER_EMAIL, CHAPTER_ATLASSIAN_API_TOKEN

Runs still show CLOUD_AGENT_INJECTED_SECRET_NAMES / CLOUD_AGENT_ALL_SECRET_NAMES entirely absent (not empty), and CHAPTER_* = UNSET. Example run: bc-ef0f862c-5a4a-405f-8ff0-366e038993a6.

Please provide the exact click path for my UI/plan/team context (/t/grpqa/) to bind this automation to a configured cloud environment, OR confirm this automation is stuck in skip-environment mode server-side (our repo draft has agentOptions.skipInstall: true but there is no UI to change it).

If the fix requires recreating the automation or a different editor flow, please specify the steps — I cannot apply your previous guidance without that control.