How AI Agent Platforms Control Your Data and Lock You In—and Why It Matters

OpenAI's rollout of ChatGPT Work alongside Anthropic's Claude Cowork and offerings from Microsoft, Amazon, and Perplexity has revealed a pattern beneath the surface of competing product pitches: the agents themselves matter less than who holds the keys to execution, state, identity, and policy.

The four archetypes shaping the market#

AI agents are being marketed along user personas rather than technical capabilities. Knowledge workers get cloud-hosted agents that delegate tasks to delegated AI. Power users get to host persistent agents on their own machines. Developers work within IDEs and sandboxes. Enterprises deploy agents within governed frameworks on managed infrastructure.

These four archetypes—knowledge worker, self-hosted power user, developer, and enterprise—each seem like distinct products. In reality, they all rely on a handful of shared technical decisions about where code executes, where agent memory lives, how users prove identity, and who enforces boundaries.

The hidden architecture beneath the packaging#

Anthropic's architecture makes this explicit by decoupling the model's reasoning from the sandbox where code runs. An append-only session log bridges them, keeping the agent's thinking separate from its actions and protecting user credentials. Competitors implement similar patterns in different ways: AWS assigns each session its own microVM with isolated resources; Google routes traffic through policy-enforcing gateways; Microsoft gives each agent a dedicated identity and per-session sandboxes that survive idle time.

What unites these platforms is vendor control of the runtime. Nearly all major providers operate the infrastructure. The difference—and the real source of lock-in—is what customers can configure and export afterward.

The four planes that decide lock-in#

Buying an AI agent today is less like purchasing a tool and more like leasing a workshop. The vendor supplies the building and power. A long-term customer installs their own security systems, maintains records, and—ideally—takes their tools when the lease ends.

The critical question is how much of the four technical planes a product exposes to customers:

• Where execution runs: Does the customer control the compute, or does the vendor?
• Where state persists: Can the agent's memory be exported and moved elsewhere?