Cursor Builds Live Apps: VibeBuilder Weekly, Nov 9

TL;DR

1Cursor added "Build Live Apps" on Nov 5: its cloud agents can build a web app, add a database and sign-in, and host it for you.

2Cursor also added voice chat with its agents on Nov 6, and Kiro added shared credit pools for teams on Nov 4.

3The Register reported a flaw in Claude Dispatch on Nov 5 that Anthropic has reportedly decided not to fix.

Top Story: Cursor Lets You Build and Host Apps From Chat

On Nov 5, Cursor announced Build Live Apps. According to Cursor, you start a cloud agent, say you want to build an app, and it sets up the web app, a Postgres database if needed, sign-in behind Cursor accounts, and hosting. Cursor says publishing runs automated security checks, and the app stays offline until they pass and you publish it by hand.

Cursor says team admins can see every app and secret on the team, add their own security review rules, approve blocked publishes, and unpublish apps. Apps can be shared with specific people, groups, or a whole team. Individual plans can also share publicly. It is available on paid plans with cloud agents turned on.

Why it matters to beginners: Cursor has mostly been a tool for people who already write code. This moves it closer to Lovable, Replit and Bolt, where you describe an app and get a link. You still need to read what the agent builds.

Why it matters to business owners: The default is private, behind sign-in, with admin controls. That suits internal tools such as a quote calculator or a client portal. Public sharing is only on individual plans, so check before putting customer data in.

Plans and Pricing

1Cursor Build Live Apps: Cursor says it is available on all paid plans with cloud agents enabled. It did not list a separate fee in its announcement.

2Kiro credit pooling (Nov 4): Kiro says enterprise admins can share credits across seats. Each seat is $20 a month and adds 500 credits to one shared pool. Extra credits last one year, and the switch from the old setup cannot be undone.

3Kiro usage display (Nov 5): Kiro CLI 3.1.0 now shows session credit use in its usage command and status line. Useful if credits run out faster than you expect.

4Cognition SWE-2 Flash (Nov 4): Cognition says this coding model is free for paid Devin users through Nov 30 in Devin Desktop and Devin CLI. Its speed and cost claims are Cognition's own and not independently checked.

Security Watch

1Claude Dispatch flaw (reported Nov 5): The Register reports that a researcher at Forever Security found that a browser extension able to control claude.ai could run commands on a linked Claude Desktop. The Register says Anthropic knew since May and has not fixed the design. Anthropic did not respond to the outlet. Treat this as a news report, not a vendor statement. Be careful which browser extensions you install.

2Cursor publish checks (Nov 5): Cursor says new apps go through automated security checks before going live. Treat these as a first filter, not a full audit. Test sign-in and data access yourself before sharing a link.

3Secrets in AI-built apps: Cursor says admins can view secrets, so keep API keys out of chat messages and use the tool's secret settings.

Not Seen This Week

Lovable, Replit, Bolt.new, v0, Windsurf, Base44, and Claude Code: I did not find a verified changelog entry dated Nov 2 to Nov 9 for these. Their latest entries I could read were from late October. No verified default-model changes in these tools either, apart from Kiro making Claude Haiku 5.5 and Kimi K3 generally available on Nov 4.

Try This Week

1If you have a paid Cursor plan, ask a cloud agent to build a small private app, such as a simple tracker, and review the security checks before you publish.

2Open your current builder's settings and find where API keys and secrets are stored. Move any key you pasted into chat.

3Open your own app in a private browser window while signed out and see whether any data shows that should not.

Events: Next 30 Days

No dated event was verified this week. A listing for an LA Tech Week Vibe Coding Camp in Santa Monica exists on Luma, but the page showed no date, so I am not listing it. Check community-events.lovable.app for current meetups.

Join the Conversation

Join the free VibeBuilder Facebook group at facebook.com/groups/1113060757712466 to share what you are building and ask questions. Subscribe to the newsletter at vibebuilder.space to get this roundup each Monday.

Sources

Cursor Changelog, Build Live Apps (Nov 5) and Voice Chat (Nov 6): cursor.com/changelog

Kiro Changelog (Nov 3 to Nov 5): kiro.dev/changelog

Cognition, SWE-2 Flash: cognition.com/blog/swe-2-flash

The Register, Claude Dispatch flaw report (Nov 5): theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684