Agent Harnesses Are Expanding to the Cloud

Agent harnesses are expanding beyond the endpoint and into the cloud. Model inference was already largely cloud-hosted. Now the agent loop - the surrounding software that assembles context, maintains state, plans work, selects tools, requests approvals, and manages execution - is being run in both locations.

The result is a more flexible architecture. An agent can keep working when a laptop closes, continue across devices, run scheduled tasks, use consistent environments, and collaborate with several people. It can still reach local files, browsers, terminals, and enterprise applications through brokered connections.

That flexibility changes the security boundary. The endpoint remains important, but it no longer contains the entire task or the evidence needed to govern it.

How the harness moved beyond the endpoint

The first widely adopted generative AI products were web chats. A user submitted a prompt, the provider ran the model, and the response returned to a browser tab. The interaction was relatively contained, even when the data-handling questions were not.

Desktop applications then brought AI closer to local work. They could interact more naturally with files, applications, and operating-system features. They became increasingly powerful as the applications they interacted with exposed evermore functionality via MCP servers. They also developed the ability to use the computer and the browser just like a human would, with no official connectors needed.

For a time, much of this execution was anchored to the employee’s computer. The device hosted the working directory, tool processes, credentials, approval prompts, and often the agent loop itself.

That is no longer the only pattern. Claude Cowork’s architecture, for example, runs its agent loop and code execution in Anthropic’s cloud by default while using Claude Desktop to broker access to local resources. OpenAI Codex offers Local, Worktree, and Cloud environments, allowing work to run either on the computer or remotely.

These are hybrid systems. The orchestration can come from the cloud, while local resources on the machine are still within reach.

Why cloud harnesses are appealing

A cloud harness separates the agent’s work from the condition of one laptop. Long-running tasks can continue without holding open a local session. Teams can use standardized environments instead of relying on each employee’s machine. Providers can add scheduling, parallel execution, shared context, and access from several devices.

It also makes agents collaborative. Claude Tag, for example, places a shared Claude in selected Slack channels. People in the channel can ask it to work, see the result, and continue the conversation. The agent can use approved tools and retain context scoped to the channel. This changes the agent from a personal assistant into a participant in a team workflow.

The same architectural shift could support shared engineering agents, research agents, service-desk agents, or operations agents that work asynchronously across applications. The agent becomes a persistent service rather than a process attached to one user interface.

The governance gap

Traditional endpoint controls see what happens on the device. Network controls see connections and, where inspection is possible, some of the data in transit. Identity systems govern authentication and access. Each remains useful, but none automatically reconstructs a cloud-hosted agent task.

The endpoint might see a file being updated or a browser action being executed without seeing the cloud-side instructions that caused it. A network tool might identify the provider and destination while missing the meaning of a prompt, the accumulated task context, or the action encoded in a tool call. An identity log might show that a connector was authorized without showing which person initiated a particular use of it.

Collaboration makes that identity problem harder. A record saying “Claude updated Salesforce” is not enough. Governance needs the chain of responsibility: who asked, who contributed, what the agent decided, which credentials it used, who approved the action, and what Salesforce recorded.

Native controls help, but need an intelligence layer

Providers are adding native visibility through Compliance APIs and OpenTelemetry, along with inline guardrails like Anthropic's inference hooks. These interfaces can expose prompts, tool calls, approvals, file access, and other activity closer to the cloud harness.

The raw events are only the starting point. Effective governance requires an intelligence layer that can interpret the user’s intent, understand the data and action in context, and, when acting inline, reach an accurate policy decision quickly enough to intervene without constantly disrupting legitimate work.

Provider visibility also has boundaries. It is strongest inside the provider’s managed, authenticated environment. It generally does not cover employees using personal accounts, unsupported applications, other AI providers, local tools, or workflows where identity cannot be reliably attributed. A provider can see deeply into its own platform, but it cannot provide a complete view of workforce AI use.

Endpoint security becomes part of a larger story

Cloud orchestration does not eliminate endpoint risk. Agents can still read local files, invoke local tools, use browser sessions, interact with applications, and access credentials held on the device. Endpoint controls remain essential for device trust, process activity, local data access, and the final mile of execution.

But endpoint visibility is now one part of a distributed evidence chain. The task may start in Slack, accumulate context in a cloud harness, call a local tool, authenticate through a connector, and modify an enterprise system.

Governance has to follow that task across surfaces. For security teams, that means combining provider telemetry with sensors on the endpoint and across connected systems. Cloud harnesses give agents the freedom to work across devices, applications, and teams. Security now has to follow them.

‍