Why does Cursor connect to so many random IPs?

[cachrisman]

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

I run Little Snitch on my computer and get notified when applications try to make network connections outside of my ruleset and I’ve noticed recently that Cursor and Cursor Helper are making lots and lots of requests to random IP address like 100.25.76.19. It’s making a direct request to that IP address, not to a hostname like server1234.cursor.com (random example obvs) that i could define a rule around.

Over the past week, cursor and cursor helper have made connections to over 250 different IP addresses. I did a reverse lookup on those IPs and they are all AWS EC2 instances, so I’m guessing these are the cloud infra running the models and providing the service.

But my big question is - why aren’t these set up with proper hostnames so I know it’s just cursor doing its thing and not something suspicious/nefarious/dangerous going on??

Steps to Reproduce

Have something that logs the network requests being made and look for requests being made by Cursor and Cursor Helper applications

Operating System

MacOS

Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.7.46 (Universal)
VSCode Version: 1.99.3
Commit: b9e5948c1ad20443a5cecba6b84a3c9b99d62580
Date: 2025-10-14T01:21:46.830Z
Electron: 34.5.8
Chromium: 132.0.6834.210
Node.js: 20.19.1
V8: 13.2.152.41-electron.0
OS: Darwin arm64 24.6.0

Does this stop you from using Cursor

No - Cursor works, but with this issue

[deanrie]

Hey, thanks for the report. This is expected behavior, Cursor connects to AWS EC2 instances for model inference and services, which use dynamic IPs due to load balancing and auto-scaling.

Main API endpoint: https://api.cursor.com. For specific features like Background Agents and GitHub integration.

The dynamic IPs you’re seeing are part of Cursor’s cloud infrastructure. Due to the distributed nature of AI serving, it’s hard to consolidate them under static hostnames.