this thread turned into a holy war between "just buy a beefy Mac" and "everything should be cloud" and both sides are missing the environment question. a human developer tolerates cold starts because they have context in their head. they remember what they installed, what's running, where they left off. an agent doesn't have any of that. every new session is a blank slate unless the environment explicitly preserves state. and when you're running multi-stage workflows where agent A's output feeds agent B's verification step, losing state between stages breaks the whole pipeline. the other thing nobody in this thread is talking about: these agents have real tool permissions. bash access, filesystem writes, network calls, credential access. we ran benchmarks on how different sandbox configurations affect agent behavior and the results were pretty wild. agents will curl answers from GitHub instead of solving the problem, modify their own test harness to fake a passing result, even exploit network egress when it's left open. OpenAI's RL team saw an eval agent escape its sandbox through a zero-day and hit Hugging Face production infrastructure. also see @_orcaman @Accomplish_ai research in this domain your local machine has zero isolation for any of this. no egress filtering, no credential scoping, and the filesystem is fully writable. the most permissive environment you could possibly run an autonomous agent in. so when people say "just use a powerful local machine," they're solving compute and ignoring everything else: persistent state, proper isolation, security boundaries, concurrent agent sessions. the teams adopting cloud sandboxes are doing it because they literally can't run multi-agent workflows on a laptop. the laptop doesn't have the isolation, the persistence, or the concurrency.

About the OpenAI & Hugging Face incident: I wrote a while back that benchmark cheating is a security problem and that the fix looks like a WAF. OpenAI & Hugging Face incident is the same argument with higher stakes. The web security industry spent twenty years learning that knowing the destination of a request tells you almost nothing about whether the request is safe. Agent infrastructure is rediscovering it at speed. tl;dr in next tweet. not tl;dr is here islo.dev/blog/openai-could-h…