Agents move beyond one desktop: cloud execution, phone control and local isolation
This week’s Cowork, Cursor and Copilot changes address where tasks run, where people control them and what commands can access. Cross-device work is easier, but local-file dependencies and permission boundaries remain separate questions.
From October 6, new Cowork tasks on Pro and Max run in Anthropic’s cloud, and the local-only setting is removed. Existing local tasks stay on their original computer. Cloud work can continue after the computer closes and resume across desktop, web and mobile; web and mobile remain in beta, with availability depending on the plan.
Connected folders are not uploaded wholesale: tasks fetch needed file copies, deleted with the session under Anthropic’s retention policy. Local-file access still requires the desktop app to be open and the session to have started on desktop. Scheduled tasks also move to the cloud, subject to that condition when using local files. Model-improvement use follows privacy settings. Claude Code remains an option for local execution, but existing projects and scheduled tasks do not transfer.
Cursor’s October 6 update takes a different route: people can view and reply to their computer’s local agents from its iOS app, after signing in and approving pairing on desktop. Agents still run on the computer, which must remain on and online; the keep-awake option requires power and an open lid. It is on by default outside Enterprise organizations, whose administrators can enable it. The announcement does not specify Android availability or an extra charge.
Local sandboxing is included with GitHub Copilot without an additional sandbox charge. It is off by default: GitHub’s current documentation says commands have the same access as the user account until it is enabled. The CLI and Copilot app have separate sandbox settings; enabling it in one does not enable it in the other.
Developers can restrict which directories commands read or modify, which networks they reach, and which credentials they use. Enterprises can require sandboxing and control its configuration through managed settings. Microsoft eXecution Container (MXC) translates the policy into operating-system controls. This restricts local processes and file access without placing commands in a separate virtual machine or container. Tool isolation is separate from model execution and does not mean the model runs locally.
Coverage has limits. GitHub’s documentation says the CLI’s built-in file tools run inside the CLI process, outside direct operating-system sandbox enforcement. They check and honor the policy themselves on a best-effort basis. Local MCP tool servers and language servers are sandboxed by default, but this is configurable; remote MCP servers are not sandboxed.
In the CLI, network enforcement differs by platform. On macOS and Linux, outbound connections are restricted to the local proxy, so programs cannot connect directly by ignoring proxy settings. Windows proxy and host rules rely on programs honoring those settings, require a supported operating-system version and local network access, and do not offer equivalent protection. Linux cannot independently control local network access for spawned commands and local services.
An unsupported computer does not always stop work. The CLI turns off a saved user preference for sandboxing in the current session and warns that commands and services will run without it. When effective enterprise-managed settings enable both sandboxing and sandbox.failIfUnavailable, the CLI blocks model requests and tool execution if it cannot enforce the sandbox. In the Copilot app, a sandbox-configured session may start, but commands and other sandboxed processes fail to launch on an unsupported host.
Check the operating-system requirements before enabling it. GitHub recommends macOS 15 or later; the backend is untested on older releases. Linux needs bubblewrap 0.5.0 or later and additional dependencies for outbound networking. Windows requires a recent, supported Windows 11 update. General availability applies to local sandboxing. The separate cloud sandbox, which runs sessions in GitHub-hosted infrastructure, remains in public preview and is billed by usage.
Sources
- Use Claude Cowork on web, desktop, and mobile — Claude Help Center
- Remote control for local agents · Cursor — Cursor：Changelog（网页）
- Local sandboxing for GitHub Copilot now generally available — GitHub
- About cloud and local sandboxes for GitHub Copilot - GitHub Docs — GitHub