AI agent security

Local vs Managed AI Agents: What the Evidence Shows

The evidence supports a narrow claim, not a broad one. An agent that runs in an environment scoped to one task and controlled by the organisation can reach less when something goes wrong than one running on a personal laptop with the user's full access. The sources we reviewed do not show that cloud-hosted agents are breached less often than local ones, and they do not give a comparative rate for either.

Hosting is not the control. What matters is what a managed environment can show you: eight areas, listed below, each verifiable. This guide sets out the argument, the documented incidents with what is confirmed and what is only claimed, and where the evidence stops.

Updated 4 November 2026

The argument for task-scoped, organisation-controlled environments

This is PlayCISO's reasoning, backed by the incidents below rather than proved by them. A local agent usually inherits what its user can reach: home directory, SSH and cloud credentials, browser sessions, every installed extension and package. When something on that machine is compromised, so is whatever the agent could have reached. An environment created for one task, from a known image, holding only that task's files and short-lived credentials, and destroyed afterwards, shrinks that reach and gives the organisation one place to log and stop it.

Two incidents show the workstation side. Cursor reported malicious extension versions that collected host information and tried to open remote access, in a marketplace used by developers. Wiz reported that malicious Nx packages used AI command-line tools already installed on victim machines to hunt for files, with flags that skip permission prompts. Neither shows that agents caused the compromise; both show that a developer machine is a shared, high-value space.

For tools that connect to many services, the Model Context Protocol security guidance makes the same point about local servers: they run with the client's privileges and should be launched with restricted file system, network and resource access.

What a managed environment must actually verify

"Managed" is a claim until it has evidence behind it. The Agent Environment Readiness tool groups the checks into eight areas (the weights it uses are PlayCISO's own judgement). Ask for each one to be shown, not described, and use the Vendor Boundary Test Kit to test it.

#	Control area	What to see
1	Verified execution isolation	Where the agent runs and proof, from the inside, that the boundary holds.
2	Brokered credentials and distinct identities	The agent acts but does not hold long-lived keys, and each agent is its own identity.
3	Step-up authorization	High-impact actions need a fresh, specific approval, not a session-wide one.
4	Task-scoped permissions	Only the files, repositories and tools the current task needs.
5	Network and data-flow restrictions	Default-deny egress, metadata and DNS paths closed, rules per operation not per host.
6	A separate production boundary	The agent cannot reach production data or deploys from its working environment.
7	Controlled software supply chain	Pinned, reviewed extensions, packages and images.
8	Independent audit and containment	Logs the agent cannot edit, and a kill switch that has been tried.

Practise them: credential brokering, step-up approval (and write the rules with the Agent Action Approval Policy Builder), egress containment, kill-switch drills, malicious extension response, AI CLI supply chain, workstation blast radius, and MCP server security. The AI Agent Guardrail Planner and AISPM Lab (shadow agent discovery) cover the surrounding programme.

Why cloud hosting alone is not security: the Manus case

Salt Labs reported that it tested Manus, an agent platform whose Gmail integration runs tasks in a cloud sandbox using the user's OAuth token. According to Salt, plain-text and Base64-encoded commands in an email were blocked, but a payload in a different encoding was decoded and run, which gave it code execution and a reverse shell in the sandbox when the user asked the agent to check their inbox. Salt says the sandbox could reach the Gmail token and that credentials for other connected services were exposed through environment variables, and that the platform's own guardrail flagged the attack only after the code had run. Salt says the flaw has been resolved; the page gives no fix date.

Caveats: this is a security vendor's account of its own research, it promotes its own product, and Salt did not test sandbox escape. The point it supports is limited and useful: a cloud sandbox that holds live tokens is still a place where an injected instruction becomes code, so the credentials, not just the location, have to be controlled. A second example comes from the vendor side: CodeRabbit said a tool in its own service was running outside the secure sandbox, per Kudelski Security's January 2025 disclosure, and described it as its own oversight. It reported no evidence of customer data access. Isolation has to be verified, including by the vendor.

Documented incidents: claimed or confirmed, and where to read the primary source

Incident	Status	Primary source	Notes
Malicious "Claude Code" extension versions in the Cursor marketplace (29 Oct 2026)	Confirmed by Cursor (the marketplace operator)	Cursor security notice, updated 30 Oct 2026	Cursor says it did not state how many users were affected, and that the attacker server is offline. Read Cursor's remediation steps for indicators.
Coverage of the same extension incident	Press report; not independently confirmed here	WIRED, 30 Oct 2026 (Lily Hay Newman)	Our automated fetch of wired.com was blocked on 4 Nov 2026, so we cite the page without restating its figures.
Nx "s1ngularity" npm compromise that used installed AI CLIs for reconnaissance (Aug 2025)	Reported by Wiz (security vendor); counts are Wiz's	Wiz, updated 29 Aug 2025	Wiz reports over 1,000 valid GitHub tokens leaked and, in a second phase, over 400 users or organisations and over 5,500 repositories affected.
GitHub MCP "toxic agent flow": malicious public issue leads an agent to publish private repo data	Demonstrated attack path; no real-world exploitation reported	Invariant Labs, 26 May 2025	Run on the researchers' own demo repositories. Invariant says it is not a flaw in the server code itself. Invariant sells a guardrail product.
RuboCop ran outside CodeRabbit's sandbox (disclosed 24 Jan 2025)	Disclosed and confirmed by the vendor; no customer data access found, per the vendor	CodeRabbit, "Our response to the January 2025 Kudelski Security vulnerability disclosure", 19 Aug 2025	Vendor's account of its own incident. CodeRabbit says RuboCop was the only service it found outside the sandbox.
Manus agent session hijacked by a crafted email, code execution in the cloud sandbox	Researcher's claim; vendor-reported fixed; not independently verified	Salt Labs (Salt Security), 1 Oct 2026	Salt sells agentic AI security products. No fix date or bounty outcome is given on the page. Sandbox escape was not tested.
Binance incident of 29 Oct 2026: signing systems induced to sign EIP-7702 delegations	Elliptic's analysis of on-chain data; Binance findings are preliminary	Elliptic, 30 Oct 2026, updated 1 Nov 2026	Elliptic says its analysis indicates private keys were not stolen and cannot say from on-chain data whether AI agents were involved. Not an agent incident on this evidence.
Accenture contractor's personal Claude agent on a Defense Department network for two months	Allegation from anonymous sources; Accenture disputes it	WIRED, 29 Oct 2026	We could not fetch this page; the URL and summary come from other outlets' coverage. Accenture says the allegations were investigated and found to be without merit.

Replit published a security advisory about managed agent environments. Replit sells a managed environment product, so we do not use it as evidence; every row above points to the research, vendor disclosure or press report itself.

What the evidence does not show

No comparative breach rate. None of the sources we reviewed measures how often local agents are compromised against cloud-hosted ones.
The surveys are self-reported. The Cloud Security Alliance reported that 54% of organisations in its study reported between 1 and 100 unsanctioned AI agents; Zenity financed that project and co-developed the questionnaire. It describes respondents, not all organisations, and we do not combine it with other vendors' surveys. See the Agent Control Gap Benchmark.
Several incidents are vendor accounts. Wiz, Salt, Invariant and CodeRabbit each describe work or incidents involving their own business. The Accenture story is an allegation that Accenture disputes.
A managed environment can still fail. See the Manus and CodeRabbit cases above.

The practical reading: do not choose on location. Choose the environment that can show you the eight controls working, and keep unsanctioned local agents visible rather than banned by memo.

Frequently asked questions

Is it safer to run AI agents in the cloud than on a laptop?

The sources we reviewed do not establish that. They document incidents on both sides, and none gives a comparative breach rate for local versus cloud-hosted agents. What the evidence does support is narrower: an environment scoped to one task, controlled by the organisation, with its isolation, credentials, network and logging verified, limits what a single mistake or hijack can reach. Hosting location alone is not that.

What should a managed AI agent environment verify?

Eight areas: verified execution isolation, brokered credentials and distinct identities, step-up authorization for high-impact actions, task-scoped permissions, network and data-flow restrictions, a separate production boundary, a controlled software supply chain, and independent audit and containment. The PlayCISO Agent Environment Readiness tool turns these into questions and the Vendor Boundary Test Kit turns them into tests. The weights in the tool are PlayCISO judgement, not a standard.

Does cloud hosting protect an agent from being hijacked?

No. Salt Labs reported that it hijacked a session of the Manus agent, which runs tasks in a cloud sandbox, using a crafted email: a payload it encoded to get past filtering was decoded and run, giving it code execution and a reverse shell in the sandbox, with access to the connected account's OAuth token. Salt says the flaw is fixed. This is a vendor's account of its own research and we have not verified it independently.

Has a managed agent service had an isolation failure?

CodeRabbit reported one about its own service. It said Kudelski Security disclosed on 24 January 2025 that its RuboCop tool was running outside the secure sandbox, and that its investigation found no evidence customer data was accessed. CodeRabbit described the lapse as its own oversight and published a remediation list. It is one vendor's statement of its own incident.

Did the Cursor extension incident involve an AI agent being hijacked?

Not as the cause. Cursor reported that malicious versions of a fake Claude Code extension were distributed through its extension marketplace on 29 October 2026 and that the code collected host information and tried to set up remote access. Cursor said Anthropic did not develop those versions. It is an example of what a malicious tool can do on a developer workstation, which is the environment a local agent shares.

What did the Nx s1ngularity attack show about AI command-line tools?

Wiz reported that malicious Nx package versions published on 26 August 2025 harvested secrets and, in the first phase, used AI command-line tools already installed on the victim machine (Claude, Gemini and Q) for reconnaissance, with permission-skipping flags. Wiz said this worked in hundreds of cases, though provider guardrails sometimes intervened. The lesson is that anything installed on a workstation can be turned against it by code running there.

What is the Accenture and Department of Defense story?

WIRED reported, citing anonymous sources, that an Accenture contractor connected a personal Claude agent to a Defense Department network and that it ran there for two months. Accenture disputes the account: a spokesperson said the allegations were thoroughly and independently investigated and found to be without merit, and that it complied with its legal and contractual obligations. We could not fetch the WIRED article, and the details here come from other outlets' coverage of it. Treat it as an allegation.

Was the Binance incident an AI agent incident?

Not on the evidence we reviewed. Elliptic's analysis indicates private keys were not stolen and that Binance systems were induced to sign using EIP-7702 delegation; Binance's own statements are initial findings. Elliptic says it cannot tell from on-chain data whether AI agents were involved. It is relevant because it shows valid access to a signing service is not authorization for a particular action.

Where can I practise these decisions?

Use the Agent Environment Readiness tool, the Agent Vendor Boundary Test Kit, the Agent Control Gap Benchmark, and the labs for credential brokering, step-up approval, kill-switch drills, egress containment, malicious extension response and AI CLI supply chain. They are linked in this guide.