Every argument about agent security this month has been framed as local versus cloud. That framing is dead. Anthropic's Claude Cowork is explicit that "Cowork sessions run in the cloud by default: the agent loop and code execution run on Anthropic's servers," and that it keeps working after you walk away: "Close your laptop and Claude keeps going." SpaceXAI's Grok Bot does the same on its own persistent cloud machine. Both are cloud. Both are always-on. The line that separates them is what happens to your credentials when a session ends, and each vendor wrote its answer down.
Read the docs, not the launch threads
Anthropic's design goal is that nothing survives. Cowork's architecture page states it plainly: "Each session gets its own sandbox, created when the session starts and destroyed when it ends." Sandboxes "don't share state with each other or across organizations." And on credentials: "Short-lived credentials only. The sandbox holds only session-scoped tokens that expire within hours. Connector authorization tokens never enter the sandbox; connector calls are made on the server side." Your Google or Slack token is never in the room with the model. The model asks the server, the server holds the key.
Around that sit governance controls with no counterpart at xAI: org-level toggles for Cowork and for cloud sessions specifically, a network policy where no network access is the Enterprise default, a mandatory egress proxy that "the sandbox can't reconfigure or bypass," and the option to "Require fresh approval for every permission-gated tool call by turning off persistent 'always allow'." Anthropic also published the most honest sentence any vendor shipped this month, and it undercuts its own marketing: "Isolation limits where Claude's code runs. It doesn't limit what Claude reads or does."
xAI's design goal is that everything survives. Its docs are equally direct: "Every Bot on your account uses the same computer." "Browser cookies and signed-in sessions are shared. Files are visible to every Bot. Command-line credentials are shared." Then the warning most reviewers skipped: "Each Bot gets its own screen on the shared computer. The screens are separate work surfaces, not separate security boundaries." "Do not use separate Bots as a security boundary." "Isolation is per user, not per Grok Bot."
Worth flagging a contradiction inside xAI's own site, because it shaped the coverage. The overview page says bots have their own computer. The computer-and-apps page says they share one. Press repeated the overview verbatim. The detailed page is the one describing the product you actually buy, and it frames persistence as the feature, not the caveat: "Browser sessions persist so you usually do not need to sign in for each task."
The other two sit between. OpenAI routes around the problem: "ChatGPT does not collect or store any data you enter during these sessions, such as passwords, because the model doesn't need it, and it's safer if it never sees it," plus a Watch Mode for outbound email and trained refusal of bank transfers. Google is the most permissive of the four. Gemini's Chrome auto-browse "can also use login info you saved in Password Manager to sign into loyalty programs and online accounts." Moot for European buyers: Gemini Spark is not available in the EEA, UK or Switzerland.
The trade is real in both directions
Persistence is not a bug someone forgot to fix. One shared cookie jar means no re-authentication loop, and it is what makes handoffs between bots work at all: a coordinator passes a task to a specialist because they see the same files and the same logged-in tabs. Take that away and handoff becomes plumbing someone has to build. Anthropic's own answer to the credential problem is a workaround, not a denial: 1Password fills the credential so Claude never sees the password or the one-time code. That is engineering effort spent avoiding a thing xAI simply allows.
Yang
"Overall, I'm still using ChatGPT as my daily driver but my bet is that OpenAI, Anthropic, and others will soon follow Grok Bot's steps with the persistent cloud computer."
The cost is equally concrete. On a persistent shared machine, one prompt injection lands inside an authenticated session, and the blast radius is not that session, it is every account on the machine. A malicious instruction buried in a support ticket or a calendar invite reaches a browser already signed into your email, your billing tool and your repo. Ephemeral sandboxes shrink that window to hours and to one job. They do not close it, which is exactly what Anthropic's own caveat admits.
The discomfort is showing up in practitioner threads, not just security blogs. On Hacker News, dgellow asked what the launch coverage did not: "Are you all comfortable with the idea of agents running non stop with access to all your accounts? I would be so anxious all the time, thinking they would leak or delete my personal data, or get hijacked via prompt injection or a security vulnerability."
What the 10x actually buys
Grok Bot entry is $200 a month through Cursor Ultra or $300 through SuperGrok Heavy, and the plan price is not the bill: "subscriptions come with weekly usage included, with additional usage billed based on token cost." Claude Cowork is included in Pro and Max. ChatGPT's nearest equivalent is $20 a month on Plus, and free on desktop. Round numbers, Grok Bot is about ten times its nearest competitor before usage.
Be precise about what the premium buys. Reviewers consistently report the underlying models are not smarter than what Anthropic and OpenAI ship. You are paying for the persistent machine, the multi-account connectors, and the fact that a non-technical operator can staff five bots in an afternoon. That is a packaging premium, not a capability premium. Evaluate it as one.
Choose by what the work touches
Stop choosing by vendor preference and choose by blast radius. Four triggers: the work moves money, the work sends messages as you, the work touches production, or the work touches customer or regulated data. If a workflow trips any of the four, it belongs on ephemeral credentials with an approval gate on the acting step. If it trips none, persistence is the faster tool and you should use it.
Practitioners are already sorting by context rather than loyalty. Nate Herk, August 12:
Herk
"If I'm sitting down at my desk and I am working on knowledge work, if I'm trying to build things, I will not be using this. I will be using my Codex, my Claude Code. Now, if I'm traveling, if I'm in the back of an Uber, if I'm on a vacation, this is what I'll be using."
Then apply the rule that survives either architecture. Hacker News commenter theshrike79 put it better than any vendor doc: "If I were to give it the ability to send mail, it sure as [expletive] wouldn't be as me. It would have its own identity and account." An agent that acts gets its own mailbox, its own billing user with a restricted role, its own scoped repo token, its own Slack account. Then the audit trail names the agent instead of you, revocation is one click instead of a password reset cascade, and the blast radius is exactly what you granted and nothing more.
Both architectures are defensible. Ephemeral is right when the work touches things you cannot un-send. Persistent is right for research, drafting and errands inside a contained identity. What is not defensible is not knowing which one you bought, and most teams comparing agent platforms right now are comparing demos and benchmarks while inheriting a credential architecture by accident.
Pick your blast radius.
Which architecture fits your work?
Book a free Diagnostic: 30 to 45 minutes, no deck, no pitch. We run your candidate agent workflows through the four triggers and tell you which ones need ephemeral credentials and a separate identity before anything ships.
Book the Diagnostic →