Factory brings autonomous coding agents inside enterprise networks

Factory has introduced Factory Private, a deployment option that runs its autonomous coding platform, control plane, and sensitive data inside a customer-managed virtual private cloud, on-premises data center, or air-gapped network. The product targets organizations whose source code, model weights, engineering telemetry, or production credentials cannot leave their security perimeter.

The control plane coordinates agents, permissions, jobs, integrations, and policy enforcement. Factory Managed keeps that layer on Factory’s infrastructure, while Droids can execute on developer machines, CI/CD systems, customer environments, or Factory-managed computers. Factory Private places both coordination and execution under the customer’s identity, access, and network controls. A separate Factory FedRAMP deployment is under development for US government workloads.

From ticket to pull request

Factory, founded in 2023 by Matan Grinberg and Eno Reyes, builds AI agents called Droids for software development, codebase research, documentation, and incident response. The company focuses on large organizations with complex repositories, including legacy systems developed over several decades.

Droids can accept an engineering task, inspect relevant repositories and tickets, modify code, run checks, and produce a pull request for review. Factory also offers longer-running “Missions” that coordinate work across multiple steps and days. The company says its agents reduced one migration project from an estimated four months to 3.5 days, although the result reflects a specific customer project rather than an independent benchmark. Factory lists MongoDB, Ernst & Young, Zapier, and Bayer among its customers.

Keeping the control plane inside

Useful coding agents need broad access to repositories, issue trackers, build systems, observability tools, and sometimes production infrastructure. That access creates a difficult security boundary for banks, defense contractors, chipmakers, healthcare companies, and research laboratories. A cloud-hosted control plane may conflict with data-residency rules, contractual restrictions, export controls, or internal policies governing intellectual property.

Factory says NVIDIA’s Nemotron research team used Factory Private in an on-premises environment while conducting post-training evaluation and optimization for Nemotron 3 Ultra. According to NVIDIA post-training director Jian Zhang, the arrangement kept code, models, and related intellectual property within NVIDIA’s infrastructure while the agents supported research workflows.

Private deployment alone does not guarantee zero data egress. Teams must also route model requests to approved endpoints, such as internal inference services or locally hosted open-weight models. External model APIs, connected integrations, update channels, and support tooling can create additional paths outside the network unless administrators disable or constrain them.

Three deployment shapes

All three options support multiple model providers. Teams can route Droids to commercial models, open-weight models, or custom internal models through their own inference gateways. That flexibility lets security and platform teams control where prompts, code, and outputs are processed, while preserving the same agent workflow across environments.

Workloads Private can reach

• Repository maintenance and modernization where source code cannot enter a vendor-hosted service.
• Model post-training workflows that keep code, weights, evaluation data, and traces inside a research network.
• Engineering tasks involving HIPAA-scoped, export-controlled, or similarly restricted data, subject to the organization’s compliance controls.
• Air-gapped development using locally available models, package mirrors, build systems, and source-control services.
• Government workloads after the relevant FedRAMP authorization and agency approvals are complete.

Compliance still depends on configuration, operating procedures, access controls, audit evidence, and the underlying infrastructure. An on-premises deployment can support those requirements, but it does not by itself certify a workload for HIPAA, ITAR, classified processing, or federal use.

Questions for an enterprise review

Factory’s announcement establishes the deployment boundary but leaves several implementation details unspecified. Engineering and security teams evaluating Factory Private will need answers to the following questions:

• Infrastructure: Which cloud platforms, Kubernetes distributions, operating systems, accelerators, and hardware profiles are supported?
• Operations: How are upgrades, security patches, license checks, backups, and disaster recovery handled in connected and air-gapped environments?
• Model routing: Which data reaches each inference endpoint, and can administrators enforce approved models by repository, team, or data classification?
• Credentials: How are short-lived tokens, secrets, service accounts, and production permissions issued and revoked?
• Auditability: Which prompts, tool calls, code changes, approvals, and agent actions appear in tamper-resistant logs?
• Governance: Can organizations require human approval before agents merge code, modify infrastructure, or access production systems?
• Commercial terms: What pricing, support commitments, capacity limits, and service-level agreements apply to private deployments?

Enterprise competition moves down the stack

Factory competes with Cursor, Cognition’s Devin, GitHub Copilot, Anthropic’s Claude Code, and internal agent platforms. Factory Private differentiates the company through deployment control: customers can host the coordination layer, execution environment, data, and model endpoints within infrastructure they govern.

Large contracts will depend on more than coding quality. Buyers will compare permission models, audit logs, model-routing controls, installation requirements, update processes, and integration coverage. Factory Private gives the company an offering for organizations where those infrastructure decisions determine whether autonomous agents can access sensitive code at all.