Environment-scoped secrets not injected into web-launched Cloud Agents, but setup agent sees them

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cloud Agent (GitHub, Slack, Web, Linear)

Describe the Bug

I have secrets configured on a personal Cloud Agent environment under Environment secrets (mix of Runtime Secrets and Environment Variables, all “All Repositories”).

The setup agent can see/use them.
Later web-launched Cloud Agents on the same environment get none of them, including Environment Variable, not just Runtime Secrets.
This is not Runtime Secret redaction. Injection never happens:
CLOUD_AGENT_ALL_SECRET_NAMES → unset
CLOUD_AGENT_INJECTED_SECRET_NAMES → unset

Steps to Reproduce

I created an environment. Started setup agent. Then I set the secrets. New agent using this environment didn’t get the secrets. I started another setup agent with “Update Existing Env” and it did see the secrets. I saved the environment multiple times and started multiple new agents, but none of them had the secrets.

Expected Behavior

Cloud Agents using that environment should receive the environment’s secrets/env vars

Operating System

Windows 10/11

Version Information

Web / Cloud Agents (cursor.com/agents)
Reproduced on 2026-07-16
Agent ID: bc-d63690f4-973b-44d4-81f5-6a6810f68416
No IDE/CLI involved in the failing runs

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

7

Hey @Mike1111!

Thanks for the report. This is a known issue with Environment-scoped Runtime Secrets, and we’re tracking this bug (I’ve just added your report as more signal!).

Until this is fixed, continuing to define these secrets as personal/team scoped instead of environment scoped will serve as a reliable workaround. This should prevent the issue you’re experiencing while we work on a permanent fix.

I can follow up here once the bug has been resolved!

9

I have both Personal scoped and Environment scoped Runtime Secrets, and none of them work.