Skip to content
The AI Agent Factory

Why both vendors chose the same design

Approved by
Panaversity ·
8 min read

The goals

These features let an AI agent do real work on a computer. They let it keep working after you close the tab. And they let it do this safely, while the model itself stays a stateless service.

Anthropic and OpenAI face similar constraints and made similar choices. Both put a harness in an isolated cloud sandbox around a stateless model, and store lasting state elsewhere. This is one design pattern, not the only one. Local and self-hosted agents arrange things differently.

What each feature is for

Feature or changeGoalBasis
A cloud sandbox for each session (a VM or a container)Give the agent a real computer (a shell, files and code) without touching your machine or other users' workIsolation for each session is vendor-documented.1 The goal is inferred
The harness runs in the cloud, not in your browser or appWork continues when the tab closes or you switch devicesVendor-documented. OpenAI says keeping state on the server "means work continues even if the tab disappears"2
One harness behind every surfaceThe same agent behaves the same way on the web, desktop, mobile, the CLI and the IDE (the code editor)Vendor-documented for Codex: "the same Codex harness" powers all experiences. For Claude, inferred: the session examined was a chat running on Claude Code, and the cloud docs list the same environments for every surface
Cloud scheduled tasksUnattended work that recurs or starts on an event, and runs with your computer offVendor-documented. Tasks "keep working when your laptop is closed"3
The bridge to your computer, and Desktop tasksReach local files and apps only when a task needs them, inside folders you chooseVendor-documented1,4
An egress proxy, and connector tokens kept outside the sandboxLimit the damage if untrusted content steers the agentVendor-documented1
The conversation is stored on the backend, and the sandbox can be thrown awayResume from anywhere, and pause or reclaim machines cheaplyInferred

Two terms in the table are new. An egress proxy is a gatekeeper that all traffic leaving the sandbox must pass through. A connector token is the key that lets a connector sign in to one of your apps.

Seven shared constraints, similar design choices

[Inferred] This is our reasoning from the documented features. Neither vendor states it. Seven shared constraints, each leading to a design response: a sandboxed computer, a harness loop, a server-side harness, one harness behind every app, reuse of Claude Code and Codex, disposable VMs with state outside, and keys outside with approvals required. Together they give the common pattern: UI, backend, a harness in an isolated sandbox, then a stateless model, with state and authority outside the sandbox.

  1. Agents must act, not just answer. Useful work means calling tools. An agent that only calls outside services may need no computer, as OpenAI's Agents API allows.5 But code and files need a computer. Because the agent can be wrong or steered, that computer is isolated.
  2. The model is stateless, and its context is limited. Something must build each call's context, run the tools, compact the context and track progress. That is the harness.
  3. Work outlives the screen. A loop in a browser tab stops when the tab closes. Long, scheduled or cross-device work needs the harness on the server.
  4. The same agent should appear everywhere. One harness behind every app is cheaper and more consistent than one harness for each app.
  5. Coding agents had shown that the pattern works. Claude Code and Codex already combined a loop, tools and a sandbox. OpenAI documents that ChatGPT Work's cloud tasks use the Codex harness.6 In the Claude session examined, a chat ran on Claude Code. Press coverage reports the same direction.7
  6. Fresh machines are cheap and safe. Light VMs start quickly, so a fresh one per session is affordable. Throwing them away limits leaks and frees capacity. So lasting state must live outside the machine.
  7. Safety has to sit outside the agent. The agent can be wrong or manipulated. So both vendors keep credentials out of the sandbox, filter network traffic and require approvals. See Security boundaries.

The common pattern: UI → backend → harness in an isolated sandbox → stateless model. Lasting state and authority (the power to decide what is allowed) stay outside the sandbox. Claude and Codex are two versions of it.

Check yourself

Question 1 / 4

0 answered

Why do the cloud products run the harness on the server?

Sources

  1. As verified on November 9, 2026. Claude Cowork architecture overview, Anthropic.↑↑2↑3
  2. As verified on November 9, 2026. Unlocking the Codex harness: how we built the App Server, OpenAI.↑
  3. Automate work with scheduled tasks, Anthropic.↑
Owner
Panaversity

On this page