chat / Cowork / Kimi / Grok / AI Studio

§1 Substrate & isolation

Where the boundary sits, and how much sits above it.

Hardening

Grok is the only environment where capabilities and seccomp were actually measured, so the not probed cells are a gap in the survey rather than a property of those environments. That asymmetry is worth stating plainly: Grok looks the most permissive in part because it is the only one that has been asked.

§2 Compute & storage

stat -f /home/workdir/artifacts
  Blocks: Total: 9223372036854775807   Block size: 4096

9223372036854775807 = 2⁶³ − 1 = INT64_MAX
INT64_MAX × 4096 = 32.0000 ZiB exactly

§3 Egress — four postures, no two alike

The most informative axis in the survey, and now the one with the widest spread.

grok, direct targets:
  https://pypi.org        -> CURL_FAIL
  https://github.com      -> CURL_FAIL
  https://www.google.com  -> CURL_FAIL
  http://169.254.169.254  -> CURL_FAIL   plain HTTP, link-local — no DNS, no TLS

grok, broker:
  http://35.245.43.102/pypi/simple/  -> 200  remote_ip 35.245.43.102

§4 Interior posture — the Grok inversion

Strictest outward, most permissive inward. Both by design.

CapInh/Prm/Eff/Bnd/Amb : 000001ffffffffff   = 41 of 41 capabilities
Docker default CapEff    : 00000000a80425fb   = 14
NoNewPrivs: 1   Seccomp: 2 (1 filter)   AppArmor: absent
/dev/kvm: present        vmx in cpuinfo: 4 lines (2 procs × flags + vmx flags)

All five capability sets full, including ambient — meaning privilege survives execve into ordinary unprivileged binaries, so it does not drop when the agent shells out. Very little sets that deliberately. Containment inside the guest therefore rests on one seccomp filter and, decisively, on the microVM underneath.

That is coherent rather than careless. If the hardware boundary is what you trust, in-guest capability restriction buys comparatively little and costs real tooling friction. It is the opposite bet from Cowork, which restricts the interior heavily — Docker daemon off, commit signing enforced, egress terminated and inspected — while running on a comparable microVM. Same class of boundary, opposite philosophy about what happens above it.

§5 AI Studio is not a peer — scoring it as one is a category error

Read the process tree before reading the findings.

PID 1 is a shell script that starts nginx, starts a Go control plane, waits for /health, then blocks on tail -f /dev/null. Behind nginx sits a Vite dev server — the application being built. There is no tool dispatcher and no execution policy gate, because the product's job is to host a preview of your app and control who can load it, not to run adversarial code safely.

None of which makes it safe for untrusted code — root execution, open egress and secrets in the process environment compose badly. The correction is to the framing, not the facts.

§6 Product posture

Five product classes, not five sizes of one thing.

§7 Cowork drift — week over week

2026-07-15 → 2026-07-24. Only fields that moved.

§8 Verification — the nonce, and why it changes the series

Grok is the first environment here whose execution was proven rather than assumed.

issued : printf '%s' '<nonce invented in the requesting conversation>' | sha256sum
returned: c3b6cb302ffb9d27f91bdc016c80a141b838884e84a49810b2452e9ecda78d37
recomputed independently:
          c3b6cb302ffb9d27f91bdc016c80a141b838884e84a49810b2452e9ecda78d37   ✓

A digest of a string with no prior existence cannot be recalled and cannot be derived. Producing it requires running code. Every other environment in this survey is trusted to have executed its probe; only this one has demonstrated it.

Three further Grok claims were verified by arithmetic rather than assertion: the INT64_MAX × 4096 workspace figure, the capability mask against a full set, and the benchmark against theoretical peak (76.1% — where real BLAS lives, and safely under the ceiling that a fabricated submission exceeded).

§9 Evidence quality & corrections

Every source here is a self-probe. The shared failure mode is over-reading output and summarising instead of transcribing.

§10 The sixth submission, and why it has no column

It arrived in this format, with code blocks, raw JSON, benchmarks and its own comparison table. It is not the product of execution.

It was offered as a column and declined — not because its findings were doubtful, but because there is no measurement to place in a cell. Load-bearing items:

• The Kubernetes cgroup path runs past f into g h i j k l. Pod IDs are hexadecimal UUIDs; the kernel cannot emit those characters.
• getaddrinfo on the numeric literal 169.254.169.254 is reported failing with a hostname-resolution error. A numeric address is parsed directly — there is no lookup to fail.
• A 2000³ benchmark implies ≈188 GFLOPS on hardware whose theoretical peak is 160. Grok's equivalent lands at 76% of peak; this one exceeds it.
• A 100 MB disk test writes into a /tmp the same document mounts as tmpfs size=65536k — 64 MB — and reports success.
• Every memory and disk figure is an exact binary power, with used and free summing precisely to total.
• A follow-up dump lists PATH without /usr/sbin while the first reports which ip resolving to /usr/sbin/ip.

Error is not fabrication. §9 publishes this series' own mistakes: calling a Go binary Rust is a misreading of a real artifact, and the finding survives correction. Here there is no underlying observation to correct toward — so no part of it can be salvaged, including the parts that look reasonable. A number that is right by coincidence is indistinguishable from one that is right by observation.

§11 Summary

The survey's central finding has held across five environments: containment and capability trade against each other, and every vendor picks a different point — but the interesting variation is not how much containment there is, it is where it is placed. Cowork puts it above the boundary, Grok puts it all at the boundary, Kimi puts it in the browser, AI Studio puts it at the front door. Reading a vulnerability count would have hidden every one of those choices.