AI agents run in one of three places, and which one you are using changes what the agent can see and what keeps happening after you walk away. Most run on the vendor's servers, inside a chat window, on a virtual computer that is not yours. Some run on your own device, as a browser extension or a separate session on your PC, using accounts you are already logged into. And some run unattended on a schedule, somewhere you never look, continuing when your laptop is shut. The third one is the fact most people have not registered.
Product behavior in this area moves quickly, so treat every specific detail below as accurate at the time of writing (August 2026), and check the vendor page linked in each section before you rely on it.
Where Do AI Agents Run? The Short Version in a Table
The architecture is not the interesting part. What changes for you is.
| Where it runs | What you actually see | Who can see the data | If you close the laptop | Works while you sleep |
|---|---|---|---|---|
| The vendor's servers | A chat window, or an "agent mode" button inside one | The vendor, plus any website the agent visits on your behalf | Your machine was never doing the work | Only if you also schedule it |
| Your own device | A browser extension, or a session running alongside yours on your PC | Whatever is on your screen or in the folders it can reach becomes part of its input | It stops, because the machine it runs on is off | No |
| A scheduler on the vendor's side | A saved list of repeating actions, with results waiting for you | The vendor, plus anything the scheduled action touches | Nothing changes, because you were never the thing running it | Yes, that is the entire point |
Place One: On the Vendor's Servers, Inside a Chat Window
This is the default arrangement in the mainstream chat assistants, and it is the least visible of the three because it looks exactly like the chat box you already use.
When you switch on agent mode in one of those assistants, the work does not move to your computer. OpenAI's help center describes ChatGPT agent as carrying out tasks using its own virtual computer, with its own browser, over on OpenAI's side (OpenAI's ChatGPT agent page). Your laptop is a screen showing you a live feed of something happening elsewhere.
Three consequences follow, and they are the useful part:
- It cannot touch your files unless you hand them over. A file on your desktop is not visible to a browser running on someone else's machine. If the agent needs it, you upload it or you connect an account that holds it. That is a real boundary, and it is the strongest safety property this arrangement has.
- Logins are the friction point. An agent on a remote virtual computer is not signed in as you. OpenAI describes ChatGPT agent pausing and handing you control of the virtual browser when a task requires a login, and states that screenshots are not captured while you have control, which is how your password is kept out of the transcript.
- Every page it visits is reached from the vendor's infrastructure, not your home connection. For most tasks this is irrelevant. For anything where the site being visited cares who is asking, it is not.
Place Two: On Your Own Device, Using Your Own Logins
The second place is your own hardware, and it exists partly because of that login friction above.
A browser agent runs as an extension inside the browser you already use, which means it inherits every session you are already signed into. Anthropic is direct about what that costs: to decide what to do next, Claude in Chrome takes screenshots of the tabs it is working in, and whatever is visible in one of those tabs is captured in those screenshots and becomes part of the conversation (Anthropic's guide to using Claude in Chrome safely). An open tab with your account balance in it is not private from an agent working in the next tab over.
The operating system version of this is newer and works differently. Microsoft's experimental agentic features on Windows put the agent in what it calls an agent workspace, which Microsoft describes as running in a separate Windows session so that agents can work with apps in parallel to your own session, with access limited to a defined set of folders and with the whole feature switched off by default (Microsoft's page on experimental agentic features).
Both vendors publish the same warning about this category, in their own words. Microsoft notes that malicious content embedded in a document or an interface can override an agent's instructions and lead to unintended actions. Anthropic calls hidden instructions in web content the biggest risk facing browser-using AI tools, says its screening reduces how often those attacks succeed, and states plainly that the risk is not zero. When the agent runs on your device with your sessions, an attack that works does not have to get past your password. It is already inside.
Place Three: On a Schedule, While You Are Not There
This is the one worth slowing down for, because it is the place people do not realize exists until something arrives in their inbox at 6 a.m.
A scheduled agent is not waiting for you to open the app. Google states that Gemini prepares your content in the background so that it is ready by the scheduled time, and that you can have up to ten active scheduled actions at once (Google's page on scheduling actions in Gemini Apps). OpenAI offers a comparable capability under scheduled tasks (OpenAI's scheduled tasks page). A published cap of ten active actions is a small detail that tells you something real: this is a genuine scheduler on the vendor's side with finite capacity, not a reminder sitting on your phone.
The thing to understand is the reversal of who is present. In places one and two, you set something running and you are there while it runs. Here you set something running once and it runs repeatedly, on days you have forgotten about it, using permissions you granted weeks ago, against accounts whose contents have changed since. If it goes wrong on a Tuesday, nobody is watching at the moment it goes wrong.
One practical exception cuts across this. A scheduled action that needs something stored only on your own machine is limited by that machine. If the file lives on your laptop and your laptop is asleep, the scheduled run has nothing to read. Anything that lives in a connected cloud account has no such limit.
How to Tell Which One You Are Using, in About a Minute
You do not need to read documentation to work this out. Three checks are enough:
- Did you install anything? A browser extension or a desktop app that asked for permissions at install time means at least part of it runs on your device. A button that simply appeared inside a website you were already using means it does not.
- Does it show you a browser you cannot touch? A live view of a browser window that is clearly not yours, with its own tabs and none of your bookmarks, is a virtual computer on the vendor's side.
- Is there a list of saved actions in the settings? Look for a settings section named tasks, scheduled actions, or automations. If it has entries in it, something is set to run without you. That list is worth reading even if you never plan to use the feature, because it is the only place unattended work is visible.
The Three Questions That Actually Decide It
Every explainer on this topic answers with a diagram. These are the questions a diagram does not answer.
Who can see the data? On the vendor's servers, the vendor and the sites the agent visits. On your device, the agent sees what you see, which is broader than most people assume and includes tabs and files you were not thinking about. On a schedule, the vendor plus whatever the action reaches, repeatedly, over time.
What happens when you close the laptop? Work on your own device stops. Work on the vendor's side never depended on your machine at all. This is the cleanest single way to think about the difference.
What keeps running when you are not watching? Only what you scheduled. That is a short list, you control it, and it is worth actually reviewing rather than assuming it is empty.
What Nobody Selling an Agent Leads With
Where an agent runs is a security design decision, not a technical footnote. The OWASP Gen AI Security Project's Agentic AI Threats and Mitigations guide treats deployment and operations as one of its named threat categories, alongside memory, tool use and planning. The people who build these systems classify "where it runs" as a risk surface. Marketing pages describe it as a convenience feature.
The honest summary is that none of the three places is safer than the others in general. Each is safer at something specific. Running on the vendor's servers keeps the agent away from your local files and makes logins deliberately awkward. Running on your device removes the login friction and hands the agent your existing sessions in exchange. Running on a schedule buys you unattended work at the price of unattended failure. No configuration gives you all three benefits at once, and a page that suggests otherwise is usually selling something. This site is not, which is the reasoning behind how this guide approaches AI coverage.
Frequently Asked Questions
Does an AI agent run on my computer or in the cloud?
Usually in the cloud, on the vendor's infrastructure. Agent features built into mainstream chat assistants run on the vendor's own virtual computer rather than yours. The exceptions are browser extensions and operating system features, which do run on your device and are normally something you had to install or switch on deliberately.
Can an AI agent keep working after I close my laptop?
It depends where it runs. Anything running on your own device stops when the device does. Anything running on the vendor's servers was never dependent on your machine, and a scheduled action will keep running on its schedule whether your laptop is open or not.
Do AI agents work offline?
Not the mainstream consumer ones. Even a browser extension or a desktop agent feature sends its reasoning to a model hosted by the vendor, so an internet connection is required. The parts of the work that happen locally are the seeing and the clicking, not the thinking.
If the agent runs on my own computer, is my data more private?
Not automatically. A local agent avoids uploading your files wholesale, but it can also see your open tabs, your logged-in accounts and whatever folders it has been granted, and it still sends what it needs to reason about to the vendor's model. Local placement changes the shape of the exposure rather than removing it.
How do I find out what is scheduled to run without me?
Open your assistant's settings and look for a section named tasks, scheduled actions or automations. Every product that offers unattended runs also offers a list of them, with the ability to pause or delete each one. Checking that list occasionally is a reasonable habit, particularly after you connect a new account.