Executive Summary
Today's three sources point the same way. Vendors are taking control of the parts of AI agents that enterprises used to assume they controlled: where execution happens, what a subscription dollar buys, and how much autonomy the model gets. Anthropic moved Claude Cowork's sandbox off the user's laptop and into its cloud. SemiAnalysis shows subscription value is an opaque meter that vendors adjust quietly. Snehal Antani (Horizon3.ai) argues that reliable production agents come from narrow, deterministic scaffolding with LLMs in a minor role, not from autonomous general-purpose agents.
The enterprise response is to own three layers: execution boundaries, usage metering, and proprietary data. Rent the model.
What Changed
- Cowork is now cloud-native. Inference and the tool-execution VM both run in Anthropic's cloud, with one isolated sandbox per session. The desktop app acts as a proxy for local file access. This replaces a local-VM design that was chosen for isolation and data minimization, and it was dropped because of battery drain, disk use, and sessions dying when the laptop lid closed. This is a vendor claim relayed through Rieseberg and has not been independently verified.
- Subscription economics are visible now. Subscriptions are about 10% of Anthropic's revenue but use more than 40% of its inference compute, which cuts blended revenue per MW by about $36M. At the mid tier, Opus 5.5 on a Claude plan delivers roughly 5x the API-equivalent value of GPT 6.1 Sol on OpenAI's equivalent plan. OpenAI cut its $200 plan's value in half without notice and confirmed limit changes through an A/B test.
- There is hard data on agent reliability. In an NCSC test, a leading pentesting LLM solved an unchanged range 3 times out of 10. LLM agents took the bait on honeytokens 95% of the time. Horizon3's production system uses deterministic automation for known steps, reinforcement learning for choosing the next action, and LLMs only for classification.
Cross-Expert Synthesis
The sources contradict each other in a way buyers should notice.
Agent scope. Anthropic is building a broad, persistent agent that runs in its own cloud and can reach back into the user's device. Antani's production evidence says broad agents are the unreliable ones. His fix is "constrained action spaces": one narrow agent per tool or control, which cuts distraction and context loss. Cowork-style products are heading toward more scope, more persistence, and more reach into local systems. Production reliability data favors the opposite.
Data location. Antani's moat argument is that the most valuable data sits behind the firewall: network configs, credential graphs, internal topology. Frontier labs cannot reach it, and per-customer knowledge graphs built from it become compounding IP. Cowork's new design moves that same local data into a vendor-hosted sandbox through a proxy. The data an enterprise should treat as its moat is now passing through vendor infrastructure by default, and the old "only explicitly added data is mapped in" guarantee has not been reconfirmed.
Cost. This link is an inference, not a claim made by either source. Cowork's persistent background sessions now run on Anthropic's cloud, so Anthropic pays for hosting the VMs as well as inference. Subscriptions already take 40% of compute for 10% of revenue. Background agent sessions billed to flat-rate seats will widen that gap, so tighter limits are the likely next step. SemiAnalysis already documents Anthropic reducing premium-model value as pricier models launch.
Enterprise Implications
Converging on cloud sandboxes moves the security question from endpoint isolation to vendor tenancy. Enterprises now need to know where tool calls execute, what gets logged, how long it is kept, and whether cross-session isolation actually holds. Approvals granted under the old local-VM model do not carry over to the new design.
Subscription seats are a poor fit for agent workloads. Their value depends on the combination of plan, model, and workload, and can drift within weeks. Agentic and coding usage is exactly the heavy usage these plans are designed to discourage. Procurement based on advertised limits goes stale quickly.
Antani's decomposition (deterministic first, reinforcement learning or rules for sequencing, LLM last) applies to internal agent builds generally, not just security. Teams building one end-to-end agent will hit the 3-in-10 consistency problem in production.
What To Do About It
- Re-review Cowork's security approval against the cloud design. Get written answers on data minimization, logging, retention, and how the proxy decides which local paths it can reach.
- Move heavy engineering usage to API billing with per-team metering. Re-run cost-per-task comparisons each time a model is released, not once a year.
- Require constrained action spaces in internal agent designs. Each agent gets one tool or one control. Deterministic steps get no LLM. Test agents against honeytokens before granting production write access.
- Classify behind-the-firewall data as strategic (topology, credentials, configs, process data), and decide explicitly whether any vendor-hosted agent can reach it.
- Talk track: "Pitch against unspent consulting budget, not headcount." Antani's point is that budget owners' careers are tied to org size, so headcount-reduction pitches meet resistance. Ask: "Which consulting line item does this replace?"
Risks and Blind Spots
Every number in today's brief is unverified. The Cowork change is a vendor statement. SemiAnalysis reverse-engineered its figures, and they will shift with the next model release. Antani has a commercial interest in showing that general-purpose LLM agents fail where his hybrid system succeeds.
The 5x Anthropic value advantage is a snapshot, not a structural fact. The same compute pressure that produces it predicts it will shrink. Do not sign multi-year seat commitments based on it.
Cloud sandboxing may be more secure than a local VM on a poorly managed laptop. The risk is not the cloud design itself. The risk is assuming old guarantees carry over without checking, and losing visibility into where proprietary data travels.