Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Is It Safer to Run a Coding Agent on My Laptop or in the Cloud?

Neither place is safer by default: the laptop keeps your sessions and files, and the vendor's cloud keeps the vendor's custody and retention. Check where the credential sits in each, and what the model receives once a page is rendered.

A credential reference travels from a browser record through a bounded route to a separate API destination.

Run one task twice, on a laptop and in a hosted sandbox, and the risk does not divide along the address of the machine. It divides along two other lines: the route the credential takes to the work, and what the model is handed when the work draws a page. A laptop brings the browser sessions a developer already signed into, the files under a home directory, and an operating system sandbox that defaults to the current workspace. A hosted task brings a machine checked out from the repository, with the provider holding the credentials the setup step needs. Each arrangement relocates the exposure rather than removing it, and each leaves the model reading whatever the page, the checkout or the command returns. The questions that follow take the comparison apart: what the boundary is on each side, where the credential sits, what the two vendors document, and which place leaves a record of what was read. The last sections turn to the control that acts before a model reads a page, and state what that control covers and what stays with the sandbox and the credential store. Rather than ranking the two places, the answers name the conditions under which either is the better choice for a task.

Key findings

  • OpenAI's Codex documentation states that "locally, Codex uses an OS-enforced sandbox that limits what it can touch (typically to the current workspace)," a boundary around the checkout rather than around the account (OpenAI, Agent, 2026).
  • OpenAI's cloud environment documentation, marked Legacy, states that secrets "are only available to setup scripts" and "are removed before the agent phase starts," custody for the setup step that leaves the agent phase and the pages it opens as the exposure (OpenAI, Codex Cloud Legacy cloud, 2026).
  • GitGuardian's test of GitHub Copilot across public repositories reported that "over 1,200 leaked at least one secret" (GitGuardian, 2025).
  • Anthropic's Claude Code security page states that "while these protections significantly reduce risk, no system is completely immune to all attacks" (Anthropic, Security, 2026).
  • An agent can satisfy least privilege in full and still hold every record it was shown, because that principle governs actions and credentials and not the content of the screen (What Is Least Exposure?).
  • Tokens before any model reads the screen keep a rendered value out of the context, so the run holds a placeholder while the real value resolves only at the approved destination when a named person approves the action, a design one vendor applies to its own agent rather than a property of either machine (What Would an Enterprise Version of Meta Muse Need?).

What changes when the coding agent runs on your laptop instead of in the cloud?

The comparison reaches its limit early, so the scope comes first. A governed browser environment covers what an agent reads and does on a rendered page: a repository settings page, a cloud console, a sign-up form, a dashboard. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. A coding agent spends most of a task in those places. The location question therefore has two halves: the process the agent runs in, where sandboxes and permission rules decide what it can reach, and the pages it opens, where the values on the screen decide what the model reads.

The laptop's boundary is the user account. Anthropic's Claude Code security page puts it plainly: "the boundary is a permission prompt, so a Bash command you approve can still write anywhere your user account can" (Anthropic, Security, 2026). That account is the one the developer uses all day, with its browser sessions, its keychain and its console logins. A sandbox around the workspace narrows where a command writes; it does not create a second identity for the agent. Whatever the task opens in that browser reaches the model as the page rendered it.

The hosted task starts somewhere else. Its machine is built for the run, checked out from the repository, and the provider holds the credentials the setup step needs. The agent does not inherit the developer's open tabs, and the credential inside the machine is one the provider placed there. That is a difference in custody, not in authority: a tether describes what an agent may do, not where it runs (What Is a Tethered Agent?).

Where does the credential sit in each place?

On the laptop the value usually sits in a file the account can read: a .env beside the checkout, a key in a home directory, a token in a settings file. Anthropic's permissions page says a team blocks its file tools from reading a path with "a Read deny rule for its path," that a .claudeignore file "has no effect," and that the rules "don't apply to a command that reads files without naming them, such as grep -r pattern ." (Anthropic, Configure, 2026). The last clause is the one that matters in practice. A rule named for a path does not stop a command that walks the directory, so the file's protection depends on which tool opens it.

Anthropic's sandboxing page adds a second mechanism: the sandbox covers shell commands only, so Read, Edit, Write, WebFetch and WebSearch follow permission rules instead, and sandbox credentials can be denied or masked, with a masked command seeing a sentinel while "the local proxy substitutes the real value only on hosts in injectHosts" (Anthropic, Sandboxing, 2026). Both mechanisms govern commands and tools. Neither changes what a rendered page shows the model.

A value used through a tool has a third route. The Model Context Protocol's security guidance warns that "MCP servers run with the same privileges as the client," so a server started beside a laptop session inherits that account's reach (Model Context Protocol, 2026). The same logic applies to a hosted task, where the server inherits whatever the task can read.

Where the value sits Laptop session Hosted task What to ask
Repository credential A file or keychain item the account can open Placed by the provider for the run, scoped to the session Which identity the credential belongs to
Cloud identity The console session already open in the browser A workload identity the machine presents, reachable through metadata What else on the machine can present it
Page reach Whatever the signed-in browser renders Whatever the task's browser session renders What the model read on the page

What do the vendors themselves say?

The two vendors whose coding agents this comparison touches document the boundary in different places. Anthropic documents custody for its hosted sessions: "GitHub credentials are stored encrypted on Anthropic's servers and never enter the session VM," with the VM holding a short-lived credential scoped to that session, a design the page describes for Anthropic-hosted cloud sessions and not for a local one (Anthropic, Security, 2026).

OpenAI documents the split between phases. Its internet-access page states that "by default, Codex blocks internet access during the agent phase," while "setup scripts still run with internet access so you can install dependencies," and it advises allowing only the domains and HTTP methods a task needs (OpenAI, Codex Cloud Legacy internet, 2026). The setup phase is the part with a network and with the credentials; the agent phase is the part with neither, unless the task changes that.

The cloud environment page is marked Legacy, so a buyer should read it as a description of a product generation rather than a commitment. Retention of the transcript and of the model's context is not described in the pages reviewed; that belongs in the contract review.

Dimension Anthropic, per its documentation OpenAI, per its documentation What a buyer should verify
Local boundary A permission prompt; an approved Bash command can write anywhere the user account can An OS-enforced sandbox, typically the current workspace Whether the limit is the OS or the tool
Network The sandbox isolates filesystem and network for Bash commands Off by default; approval needed for commands that need it Which domains a task really needs
Cloud credential GitHub credentials encrypted on Anthropic's servers, never in the session VM Secrets only for setup, removed before the agent phase Which of your values are secrets and which are variables
Setup phase No statement in the pages cited A separate Bash session with internet access What setup can reach before the agent starts
Agent phase Sandboxed commands isolated; the prompt is the boundary Internet blocked by default; approval outside the workspace Whether an install during the agent phase is possible

Which place leaves a record of what the agent read?

The record a laptop leaves is a transcript and a shell history on the developer's disk, plus whatever request logs the model vendor keeps. A hosted task leaves a work log and a transcript in the provider's account. Neither is a record of what the model read; both are records of what the agent did. The difference is custody: whose disk holds it, how long it is kept, and whose legal process can reach it.

Why the reading matters more than the doing: the memorization study found that neural code completion tools "can not only return the precise piece of their training data," and its authors report that "two valid credentials were identified during our experiments" (Huang et al., Your, 2024). Everything in the context is text a model can reproduce. What the agent read is the input to that risk, and a log of actions does not capture it.

Willison's note on design patterns points at the same gap: the patterns "constrain the actions of agents to explicitly prevent them from solving arbitrary tasks," and one of them lets agents "trigger tools, but cannot be exposed to or act on the responses from those tools" (Willison, 2025). That design keeps a response out of the agent's reach. It is a constraint on the tool, not a property of the machine the tool runs on.

A browser agent adds a third record, because it sees what is on the page and can act on it, the point Does Claude in Chrome Use Your Saved Logins and Open Sessions? makes about the page as the unit of exposure. A work log records the click; it does not record the account number on the screen behind it.

Does the cloud remove the problem the laptop has?

The move to a hosted task changes custody, and custody is worth having. The provider builds the machine and places the credential, and the documented design removes the credentials before the agent phase. What it does not change is what the model reads: the agent still opens a repository settings page, a console and a dashboard, and the model still receives what those pages render. A control that lives in the provider's machine image governs the machine; it does not govern the page.

The record on defenses says the same. The Agent Security Bench reports that its "benchmark results reveal critical vulnerabilities in different stages of agent operation," with "limited effectiveness shown in current defenses" (Zhang et al., 2025). The finding is about the layer a defense sits on, not the location, and that layer is the same on either machine.

The cloud also adds an exposure the laptop does not have. The guidance notes that "cloud metadata endpoints often expose IAM credentials, API keys, and other secrets," a risk that follows a machine's cloud identity wherever the agent runs (Model Context Protocol, 2026).

Federation answers part of this: OIDC settles how the pipeline authenticates, so a deployment uses a short-lived federated token instead of a stored key (How to Set Up S3 and GitHub With Cowork or Dots). The advice in Is It Safe to Let an AI Agent Set Up Your Cloud Environment? points the same way, and neither closes the route through a rendered page.

What does a governed environment change?

The control class this page ends on is defined by where it acts, not by where the agent runs. A governed environment acts at the moment a page is drawn, before any model reads it. Values chosen by policy become consistent tokens for the whole run, so a settings page renders DEPLOY_KEY_004 where the key sits. Real values resolve only at the approved destination, when a named person approves the action that needs them, and that person confirms the policy behind each token. Every screen as tokens, every action and every approval goes to a record that exports to the organization's own monitoring.

The machine stops being the unit of analysis. The same pages render the same way on either machine: the model holds tokens, the form holds tokens, and the real value appears only in the approved submission. What differs is who holds the machine and its credentials. What does not differ is what the model received from the pages it opened.

The control also has an edge, and it is the edge stated at the start. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP. A command that prints a variable, a test that reads a fixture, an install script: those are governed by the sandbox, the permission rules and the credential store, not by the page. A team that needs both places covered needs both controls, and should not read a page-level guarantee as a machine-level one.

Remote browser isolation is the nearest documented relative, and it is different. It executes page content in a browser on the provider's infrastructure and sends the endpoint a representation of the result, in Cloudflare's design a stream of draw commands rather than page code (How to Protect Data Without Cloud Browser Rendering?). The governed environment moves what the model is handed, which is the part the location question leaves open.

Methodology and limitations

This page rests on vendor documentation from Anthropic and OpenAI, a specification from the Model Context Protocol project, one vendor research post, one practitioner note, and existing research pages on agent authority and what a screen exposes. Two research preprints supply the risk figures, and the vendor and specification pages supply the mechanisms. Vendor pages were read between October 20, 2026 and October 21, 2026, and each Sources line carries the date for its page. Quoted facts are cited to the page that states them. The preprints are cited for what their abstract pages report, not for rates those pages do not give, and the sandboxing page is cited for the mechanism it documents, not for how a particular deployment uses it.

RedactSure did not test any of the named products hands-on. Where this page says a behavior is not described in the pages reviewed, it means the recorded facts for that page do not cover it, and the vendor is the right place to ask. Vendor features change, and the page carries its date; a release after that date is unreviewed until the comparison is repeated. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, a deploy key on a repository settings page run once on a laptop and once in a hosted task, and not an organization.

Determinations about whether a particular arrangement meets a contractual, regulatory or internal control requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a test of the organization's own agent on both machines, repeated after each vendor release.

What the record shows

The two places answer the title with different custody and the same exposure. A laptop gives the agent the developer's account, the browser sessions already open and the files under the home directory, with a sandbox that limits writes and a permission prompt that decides them. A hosted task gives the agent a machine built for the run, with the provider holding the credentials and removing them before the agent phase. Each arrangement produces a log of actions; neither produces a record of what the model read. The research record explains why that gap matters: completion tools return training data, and current defenses show limited effectiveness. The control that closes the gap sits at the rendered page, and RedactSure builds its environment there. Run the same test on both machines with one named agent and one task, and ask of each rendered page what the model received and who approved the write.

Frequently asked questions

Is it safer to run a coding agent on my laptop or in the cloud?

Neither is safer by default, because the two places fail differently. The laptop gives the agent your account, your open browser sessions and the files under your home directory, with a sandbox that mainly limits writes. The cloud gives it a machine built for the run, with the provider holding the credentials and removing them before the agent phase, but with the same pages rendered to the model. Choose per task by asking where the credential sits and what the model receives.

What does the laptop expose that the cloud does not?

Your account and everything already signed into it. A permission prompt decides what a command may do, but the browser holds the sessions you opened, and the home directory holds the keys and settings files the agent can read. Anthropic's permissions page notes that a deny rule does not cover a command that reads files without naming them, so a rule on one path is not a rule on the directory. Test the paths a task touches on a copy before relying on either.

Does the cloud keep my credentials away from the agent?

It keeps some of them away, for part of the run. OpenAI's cloud environment makes secrets available only to setup scripts and removes them before the agent phase, while environment variables persist for the whole chat. Anthropic stores a hosted session's repository credential outside the session machine. Both pages describe controls on what the agent may do. What a rendered settings page shows the model is the question neither answers, and it is the one to put to the vendor.

Does a sandbox protect the files on my machine?

It protects what the vendor says it covers. Anthropic's sandboxing page describes a sandbox over shell commands, with file and web tools following permission rules instead and a masked credential replaced by a sentinel for sandboxed commands. OpenAI's local sandbox is enforced by the operating system and typically limited to the current workspace. Read the definition for the tool you use, then test one real path on a copy of the file before a task runs against the original.

What should I check before choosing one?

Four things. Where the credential sits, and who can read it. What the boundary is, an operating system sandbox or a permission prompt. What the model receives from each page the task opens. And what record survives the run, on whose disk and for how long. A provider that answers three of the four has told you where it stops, which is as useful as the answers it gives. Write the four answers beside the task.

Can a coding agent work on a page without reading the values on it?

Yes, when the page is drawn with tokens in place of the values. The agent works the form, the search field or the settings page with a placeholder such as DEPLOY_KEY_004, and the real value resolves only at the approved destination when a person approves the action. That approach governs the rendered page. A terminal command, a file read and a direct API call stay outside it and depend on the sandbox and the credential store the team configures.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps the Credential Off Both Machines

Moving a coding agent between a laptop and a hosted task relocates the exposure, and neither setting governs what the model reads when a page is drawn.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Take one task, adding a deploy key on a repository settings page, on a laptop and in Codex cloud. Before: the signed-in page renders the key and the model receives it. Inside: the page renders DEPLOY_KEY_004, and the real key appears only on a named person's approval.

RedactSure is deploying now with enterprise and government customers. Anthropic states that no system is completely immune to all attacks.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

On a laptop or in the cloud, the page that shows the credential looks the same to the model. Bring a deploy key task your team delegates and see, with test values, what the model receives on that page. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.