Two of the largest consumer tech companies have converged on a singular infrastructure pattern for AI agents: the persistent cloud virtual machine. Both xAI’s GrokBot, which entered beta on August 11, 2026, and Meta’s Muse, launched September 8, 2026, provide agents with a dedicated browser, filesystem, and terminal environment. This shift marks a transition from ephemeral, stateless execution to long-lived, stateful workspaces.
While the surface-level infrastructure is identical, the underlying architectural philosophies diverge sharply. The choice of where to draw the security boundary reveals two distinct bets on how agents should interact with sensitive data and external systems. GrokBot is built on a coordination-first philosophy. It provides a persistent cloud computer per user account, where all of a user’s bots share a single environment. xAI’s documentation is explicit about the implications of this design, noting that bot screens are merely separate work surfaces rather than separate security boundaries. The company warns users: “Do not place a credential or file on it if another Bot on your account should not be able to use it.” In this model, the security boundary is set at the account level, relying on Firecracker microVM isolation to separate one user from another, but leaving individual bots within an account to share a common runtime.
Conversely, Meta’s Muse adopts a security-first approach. Muse utilizes a dedicated, isolated Linux virtual machine for each user, but introduces a more granular control layer through Sentinel. Sentinel acts as a host-side agent that serves as the sole permission authority for all connector actions and network egress. The runtime itself operates within a systemd-nspawn container, and credentials are kept in secure storage outside the agent’s runtime, with just-in-time insertion at the network boundary. As detailed in their security and safety approach, this design ensures the agent never sees real tokens, effectively moving the security boundary from the account level down to the individual action level.
This divergence highlights a hidden structural tension in the agent economy: the agent is simultaneously an extension of the user and a governed process. The GrokBot model treats the agent as a user-proxy, prioritizing the ease of coordination and shared state across a suite of tools. The Muse model treats the agent as a potentially untrusted process that requires strict, automated oversight.
These competing designs validate the ongoing evolution of the governance stack. As we have previously explored, the industry is moving toward unified runtime enforcement as a necessary layer for agentic systems. Whether through Meta’s Sentinel or other emerging frameworks, the industry is reaching a consensus that runtime enforcement is crystallizing as a mandatory component of agent infrastructure.
For builders, these two models represent different architectural bets. A coordination-first approach may be better suited for high-velocity, low-friction workflows where agents must collaborate closely on shared files. A security-first approach is likely the standard for enterprise environments where the risk of prompt injection or unauthorized data access necessitates defense-in-depth, such as Meta’s use of prompt-injection classifiers and human-in-the-loop approvals. The convergence on persistent VMs is only the beginning. The real competition in agent infrastructure will not be over the existence of the VM, but over the sophistication of the governance layer that sits on top of it. Builders must now decide whether their infrastructure will prioritize the fluidity of the agent’s workspace or the rigidity of its permissions.