Cloud and Background Agents

Cloud agents take an issue or a written task, run in an environment the provider hosts, and return a branch or a pull request, the practice Chapter 13 described. As of October 2026 every large vendor offers one, usually as the third member of a family that also has a terminal or editor tool. You start it from a browser, an issue, a chat panel or your terminal, and it keeps working after you close the laptop.

This page gives its four main agents the same six fields as the previous two, checked against the vendors' documentation in October 2026. The permission field is split into the four settings Chapter 13 asked about: what the repository token can push, what the network allows, which secrets the environment holds, and what happens to the test run on the agent's pull request.

The Category and the Table

All of them share a shape: a fresh clone, a setup script, a branch, a log of what ran, and a pull request or a diff for you to turn into one. They differ in the four permission settings, and the table sets those side by side. Read across a row and you have the worst case for that product, as of the month it was checked.

Agent	Pushes to	Network	Secrets	CI on its pull request
Copilot cloud agent	one branch: a new copilot/ branch, or the pull request's	firewall on by default, allowlist	configured for the agent	waits for a person to approve
Codex Cloud	you open the pull request	full, or package registries plus named hosts	network secrets substituted by a proxy	your repository's own rules
Claude Code cloud sessions	any branch your branch rules allow	none, trusted, full or custom; trusted by default	kept outside the VM, attached by a proxy	your repository's own rules
Cursor Cloud Agents	a separate branch	outbound domains can be restricted	injected when the agent starts	your repository's own rules

Agent	Assigned from	Setup	Billing
Copilot cloud agent	issues, pull requests, chat	a hosted sandbox, or a setup workflow file	AI credits plus sandbox or Actions compute
Codex Cloud	the Codex app and web	an environment with an install script	ChatGPT plan usage
Claude Code cloud sessions	browser, apps, terminal	an environment with a setup script	plan usage limits
Cursor Cloud Agents	the editor, dashboard and integrations	a full development environment	plan usage, with a spend limit

Copilot Cloud Agent

• What it is. GitHub's agent that researches a repository, plans and implements changes in the background, and opens a pull request. It was called the Copilot coding agent until spring 2026, when GitHub renamed it and extended it beyond pull-request work.
• Setup. Enabled for a repository or organisation and assigned from an issue, a pull request or a chat. Since 28 October 2026, sessions on paid plans can run either in a sandbox GitHub hosts, the default where a choice is offered, or in a GitHub Actions environment. Only the Actions environment runs setup steps, from a workflow file, .github/workflows/copilot-setup-steps.yml, whose single job must have that exact name and which must be on the default branch.
• Instructions file. The same files as the editor assistant on the previous page, plus CLAUDE.md and GEMINI.md.
• Permissions. Only users with write access can assign it. It can push to a single branch: a new one it creates, or the branch of the pull request it was asked to work on, and branch protections and required checks apply to it. Its internet access goes through a firewall that is on by default, which the hosted sandbox follows too, with a recommended allowlist of package registries; the documentation warns that the firewall covers only commands the agent runs and is not a complete security boundary. Workflows on its pull requests wait until a person with write access approves the run. It cannot approve or merge its own pull request, and the person who asked it to create one cannot approve it either.
• Billing. AI credits for the model, plus compute for the sandbox or the Actions job it runs in, which draws on a monthly compute allowance on the GitHub account that is separate from the credits.
• Maps to. Chapter 13's environment as the permission model, almost field for field, and Chapter 14's meters.

Codex Cloud

• What it is. The cloud member of OpenAI's Codex family: tasks run in isolated workspaces built from a reusable environment, and you review the changes and test results before committing or opening a pull request.
• Setup. A cloud environment records the repositories, dependencies, tools and access settings, with an install script that prepares dependencies and a step that starts services and checks they are ready.
• Instructions file. AGENTS.md, as for the terminal agent.
• Permissions. Internet access is either full or restricted to package-manager domains plus hosts you name. Network secrets reach programs as placeholders, and a proxy substitutes the real value only for allowed destinations, so the raw credential is never written into the workspace.
• Billing. Drawn from the ChatGPT plan's Codex usage. The older version of the product, now labelled legacy, still runs code review and the GitHub and Linear integrations, and OpenAI says it plans to deprecate it.
• Maps to. The sandbox of Chapter 3 and the credentials rule of Chapter 12, with the proxy design as a concrete answer to "the agent needs a key it must not see".

Claude Code Cloud Sessions

• What it is. Claude Code sessions that run on virtual machines Anthropic manages, or on a team's own infrastructure, started from the browser, the mobile app, the desktop app or the terminal, and pushing a branch you turn into a pull request. A related feature watches a pull request and pushes fixes for failing checks and review comments.
• Setup. Connect GitHub through the vendor's GitHub App or your own command-line token. Each session runs in a cloud environment with network settings, environment variables and a setup script, cached when it finishes within about five minutes.
• Instructions file. The same files as the terminal agent, read from the clone.
• Permissions. Network access is none, trusted, full or a custom allow-list, and the first environment a user gets is set to trusted: package registries, GitHub and cloud SDKs. Git credentials stay outside the virtual machine, attached by a proxy. The proxy refuses branch deletions and tag pushes, but it does not limit which branches a push can update, and the documentation sends you to your repository's branch rules for that. Replies it posts on a pull request appear under your account, labelled as the agent's.
• Billing. Counted against the plan's usage limits with the rest of your usage, with no separate charge for the machine, on the paid individual and team plans.
• Maps to. Chapter 12's least privilege, with one setting to check before anything else: the push limit is your branch protection, not the agent.

Cursor Cloud Agents

• What it is. Agents that run in isolated virtual machines in the cloud with a full development environment, formerly called Background Agents.
• Setup. Started from the editor, the web dashboard, a chat or issue-tracker integration, or a comment on the code host, with secrets added in the dashboard.
• Instructions file. The same rules files as the editor on the previous page.
• Permissions. Each agent works on a separate branch and pushes for handoff. Outbound network domains can be restricted. Secrets are injected when an agent starts, so an agent already running does not see a secret added after it began.
• Billing. The plan's usage, at the chosen model's rate, and you are asked to set a spending limit the first time you use them.
• Maps to. Chapter 13's permission fields, and the parallel work of Chapter 9 moved off your machine.

Others, and the Common Question

Other vendors offer cloud agents too. Cognition, which makes the editor on the previous page, sells an agent product built around assigned tasks, and Google has run an asynchronous coding agent of its own; this month's check could not confirm the four permission settings of either from current documentation, so neither has a row. The table will change again next month.

Whatever the product, the question from Chapter 12 is the same, and the table's permission columns answer it in one line: if this agent did the worst thing its environment allows, what could it reach? Read the row for the push target, the network, the secrets and the test run on its pull request. If the honest answer includes the default branch, the open internet and a production key, change the settings before assigning the first issue, not after.