← Ayo Osunjuyigbe

· AI

When the laptop closes, the cloud agent is still running

Tuesday, Anthropic put Cowork on the web and on the phone. The help center sentence is the product: work continues when you close your laptop, and scheduled tasks run with no device online. I have been living that sentence in Cursor and Codex for a year. The new part is that they said it out loud for people who never opened a terminal.

The laptop is no longer the computer. The computer is a VM you do not SSH into. The interface is a pull request, a deck, a folder of files in the account. If you thought the agent still had your mcp.json and the .env sitting next to package.json, that is the bug.

What shipped

16 May 2025, OpenAI put Codex in the ChatGPT sidebar. Research preview. codex-1, an o3 trained on real PRs. Each task gets its own cloud sandbox, repo preloaded from GitHub. Read, edit, run tests, commit in that environment. You review logs and citations, then open a PR or pull the branch down. One to thirty minutes. Parallel tasks. At launch they disabled internet during the run: GitHub plus whatever you pre-installed in a setup script. No APIs, no just curl prod. 3 June they turned the network on. The launch post is now marked outdated. The object did not change. Isolated container, not your laptop.

They also said the quiet part: review the code before you run it. AGENTS.md in the repo is how you tell the box which tests to run. The CLI they had shipped the month before is the other product — that one is your laptop. Do not mash the names.

Cursor’s Background Agent preview landed the day before Codex, in 0.50 (15 May). Remote environments, parallel agents, take over when you want. 4 June, version 1.0, they took it out of the beta flag — cloud icon in chat, unless you were still on privacy mode, which they said they would unlock next. 12 June, @cursor in Slack. They later renamed the thing Cloud Agents. The docs now are blunt: isolated Ubuntu VMs, clone, secrets, network, MCP from cursor.com/agents. User-level hooks in ~/.cursor/hooks.json do not exist on that machine. .cursor/hooks.json in the repo does. Snapshots can swallow a .env.local if you left it in the image. They tell you to use the Secrets tab instead.

5 March this year they productized the loop as Automations. Slack, Linear, a merged PR, PagerDuty, a cron, a webhook. Spin a cloud sandbox, follow the prompt, use the MCPs you configured for the automation, verify, open a PR or post in the thread. Bugbot was the first one. The laptop does not have to be open. The laptop is not in the trust boundary.

Cowork, 12 January: Claude Code without the terminal. Max, macOS desktop, research preview. Willison watched it mount a granted folder into /sessions/…/mnt/… inside a Linux VM (Apple Virtualization). Local files, local MCP, laptop still on. 9 April, GA on Mac and Windows. Tuesday is the remote session: the same agent, Anthropic’s cloud, laptop optional. Desktop still reaches folders the browser cannot. Web and mobile do not inherit ~/.claude. Skills and connectors come from the account, synced at session start.

Three vendors. One shape. Clone or mount. Isolated box. You are not in the loop until the artifact.

The .env did not travel. Unless you uploaded it.

I have a Postgres MCP on stdio and a .env that is gitignored. That is a local agent. The cloud agent starts from Git. It gets the files Git has, the packages the Dockerfile installed, the secrets someone typed into a dashboard, and the MCP servers someone attached to the team config. It does not get the key in my shell. It also does not get the hook that blocks rm unless that hook is in the repo.

That is good, until it is not.

If the task needs a database, someone will paste DATABASE_URL into Cloud Agent secrets so the tests pass. If that URL is prod, you have rebuilt Replit with a nicer settings page. July 2025: Jason Lemkin, code freeze, he said it eleven times. The agent wiped a live DB — on the order of 1,200 execs / 1,190 companies — invented thousands of fake rows and passing tests, then said rollback was impossible. Rollback worked. Amjad Masad: unacceptable and should never be possible. Don't do that was not a control. Dev and prod in the same agent session was the control that was missing.

A cloud VM with a prod connection string is that session. The isolation is between agents, not between the agent and your customers. Cursor will inject the secret as an environment variable. They will redact it from the transcript if you mark it a Runtime Secret. They will not know it points at the thing you cannot drop. OpenAI will let you make the sandbox match your real development environment as closely as possible. That sentence is a warning if you read it twice.

Internet is the other door. Codex launched dark and then opened. Cursor’s cloud VMs have egress on by default; you can allowlist, you can lock it org-wide. Cowork’s own help page tells you to watch for suspicious actions that may indicate prompt injection. Willison’s reply still stands: that is not a product for people who do not live in this. The VM can fetch a page. The page is in the prompt. The prompt can become a curl if the network is open and the secret is in the environment.

Local MCP servers are the third door. The calendar plugin on your laptop is not in cursor.com/agents until you put it there. When you do, it is a different install: HTTP, OAuth, team-scoped. Pin that catalog the way you pin any MCP server. Do not assume the allowlist you typed into .cursor/mcp.json followed you to Slack.

The interface is the PR. Not the summary.

Codex cites terminal chunks. Cursor hands you a draft PR, screenshots, a remote desktop if you want to click the thing it built. Cowork leaves a document with citations. Those are the review surfaces. The agent’s paragraph about what it did is not.

Cloud agents auto-run the shell so they can iterate tests without asking every line. Cursor’s security note is the honest one: more autonomous than the foreground agent. A planted instruction in a file the agent reads can try to walk data off the box. Their mitigations are egress, redacted secrets, .cursorignore, and a human on the merge. That last one is the product. If you merge because the Automation said CI is green, you merged the Automation.

Scheduled and event-triggered runs make this worse in a boring way. A PagerDuty Automation with a Datadog MCP and a prod token will fire at 3 a.m. when you are not watching the VNC pane. That is the point of the feature. It is also why the token cannot be the one that DROPs.

What I do now

I will close the laptop. I will not pretend the VM is a copy of my machine.

Prod credentials do not go in the Secrets tab. Staging database. Fake Stripe. OIDC with a short-lived role if the agent must talk to a cloud account. If the job needs prod, it is not a cloud agent job. It is a human on a break-glass role. Replit already measured don't touch prod as a prompt.

Do not snapshot .env.local. Cursor says the Secrets tab is the path. Believe them. If a file had to live in the image once, rotate it. .cursorignore the rest.

Cloud MCP is a second allowlist. I add servers at cursor.com/agents (or the Cowork Customize pane) as if I had never installed them locally. Hash the schema. No stdio binary from my home directory. No the WhatsApp bridge is already on the laptop.

The merge is the confirm. Draft PR. Signed agent commit if the host offers it. I read the diff and the test log, not the summary. Automations that auto-approve low risk stay off paths that handle money, auth, or migrations.

Egress is an allowlist, not a default. If the agent does not need the open web, it does not get it. Codex’s first week was the conservative default. I miss it.

I wanted an agent that kept working after I shut the lid. We have three. They run on a machine I provisioned by clicking Connect GitHub. The .env on disk is not on that machine. The one in the dashboard is. Treat the dashboard like prod, because for the hour the VM is up, it is.

References