AI
Four AI agent platforms take radically different stances on security boundaries
As Grok Bot and Hermes race to mainstream multi-agent workspaces, they're drawing security lines at completely different layers—account, profile, runtime, or container—leaving operators confused about what's actually isolated.
The New Stack
When multiple AI bots work in parallel, a single mistake by one bot can cascade into trouble: its error might expose another bot's credentials, compromise shared files, or even threaten the host machine itself. This month brought two high-profile releases—Nous Research's Hermes Bot Mode and SpaceX's Grok Bot—both offering a nearly identical interface of named teammates collaborating on tasks. Yet beneath their surface similarity lies a critical divergence: each platform draws the security boundary at a fundamentally different architectural layer, and operators risk building false confidence if they assume the bot roster itself provides isolation.
The converging interface, diverging boundaries#
Both Grok Bot and Hermes present users with a sidebar of named agents that hand off work to one another. The naming alone (Expense Manager, Talent Scout) evokes separation, as if each bot occupies its own room. In reality, the documentation reveals four very different answers to the question: When one bot fails, what can it reach?
- Grok Bot isolates at the user account level: a single persistent cloud machine where all bots share browser cookies, files, credentials, and command-line sessions.
- Hermes isolates at the profile directory: each bot gets its own configuration, memory, credentials store, and chat history on disk, though all profiles share the host OS and filesystem.
- OpenClaw offers optional runtime sandboxing: agents execute inside isolated Docker containers, though the setup defaults to off.
- ClawFleet moves isolation into deployment: a wrapper that places each agent in its own container with isolated filesystem and network, at a cost of ~150–500 MB per instance.
No two of these units are equivalent, and an operator who assumes the roster alone is the boundary will be correct in exactly one case.
Grok Bot: Shared cloud desktop with a warning label#
Grok Bot's launch post promises each bot its own computer. The fine print reveals that the computer is singular and shared. All bots run on one persistent cloud machine assigned to the user account, not to any individual agent. Browser sessions, installed connectors, and command-line credentials are account-wide. Files stored in /workspace survive machine recovery, durable across the entire roster.
