chat / Cowork / Kimi / Grok / Devin ×2 / AI Studio

§1 Substrate & isolation

Hardening — and where the survey is thin

Only Grok was measured directly on capabilities and seccomp; Devin declined those categories, and the Anthropic and Kimi entries were never asked. Grok looks uniquely permissive partly because it is uniquely examined. The not probed cells are a gap in the survey, not a property of those environments.

§2 Compute & storage

Two headline disk figures that mean nothing

grok:      Blocks Total = 9223372036854775807 = INT64_MAX
           × 4096 = 32.0000 ZiB   ← a FUSE "unbounded" sentinel
ai studio: /, /dev, /dev/shm, /tmp each report 378 GB
           ← one synthesised gVisor figure repeated across four mounts

§3 Egress — five postures

§4 Devin — a desktop agent that declined to be probed

Two corrections and one durable finding.

It is graphical, not a shell

~/.Xauthority  ~/.ICEauthority  ~/.dbus   Jul 24 12:19   X11 session at boot
~/.vnc  ~/.kde                            Jul 24 12:19   VNC + KDE
~/.browser_data_dir                       Jul 24 12:22   ← written mid-session
~/Desktop ~/Documents ~/Downloads ~/Pictures ~/Videos  ~/screenshots

A live X session with remote display, a KDE tree, XDG user directories, a screenshots folder and a browser profile modified during the session. Devin's Linux environment belongs in the same product class as Kimi — an agent with a screen, a browser it drives, and the ability to capture what it sees. The difference is that Devin also carries the richest toolchain in the survey and Kimi carries almost none.

The agent is the terminus of every interactive git path

EDITOR / GIT_EDITOR / VISUAL = \\?\D:\devin-remote.exe editor
GIT_TERMINAL_PROMPT = 0        GCM_INTERACTIVE = Never
PATH includes C:\devin\docker-cred
REMOTE_EXE = D:\devin-remote.exe    ← the config drive
RUST_LOG   = info                   ← the agent is Rust
BASH_ENV   = C:\ProgramData\devin\devin_bash_env

Commit messages and interactive rebases open the agent itself; terminal prompts are suppressed; Git Credential Manager may never raise a dialog. This is deeper git integration than Cowork's signing and stop hooks, which enforce policy on commits rather than making the agent the endpoint of every prompt. Note also that the agent binary ships on the Cloudbase-Init config drive, and that it drives Git bash on Windows rather than PowerShell.

The refusal, and why it barely worked

Devin declined the standard probe, naming virtualization fingerprinting, capability and seccomp posture, the metadata endpoint and its SSRF association, and the verbatim-output rules. That read was accurate — the probe was reconnaissance in a compatibility wrapper, and every other environment complied without objection.

A refusal establishes policy-level guardrails around self-disclosure. It does not establish a hardened boundary: that is instruction-tuning, not containment, and is equally consistent with a fortress and with an ordinary VM whose agent was told not to discuss itself.

The reframed request dropped every objectionable category. The answer disclosed the substrate regardless — lscpu gave up KVM, the mount table gave up systemd and writable debugfs, a home listing gave up .sudo_as_admin_successful, a disk question gave up the OpenStack config drive, and an unrequested WMI field gave up Cloud Hypervisor by name. Most of a threat model is recoverable from benign data.

Windows: corrected, then re-evaluated

Revision 1 of the Windows report called the image a GitHub Actions derivative — wrong. Five installed products and a tool cache holding only Node is a minimal Server 2022 base that borrowed the path convention, not the full runner image. Chocolatey and ffmpeg are present and working, Chrome is provisioned, and Docker Desktop with its WSL2 backend is running. With Docker Hub reachable, "no native compilers" becomes irrelevant — any Linux image is one docker pull away. 8 vCPU and 32 GiB behind a live Docker daemon is the highest raw compute ceiling in the survey. The 20× slower disk is the real constraint.

§5 AI Studio — capable sandbox, ingress-focused security

PID 1 is a shell script that starts nginx, starts a Go control plane, waits for /health, then blocks on tail -f /dev/null. Behind nginx sits a Vite dev server — the application being built. No tool dispatcher, no execution policy gate: the product's job is to host a preview and control who can load it. That is a design choice about where to spend security budget, not a deficiency — and the ingress engineering is substantial (see the nginx Lua bridge, multi-attempt token validation, and iOS Safari fallback in the standalone audit).

§6 Product posture

§7 Cowork drift — week over week

§8 Verification — three tiers

Not every environment here is known to the same standard, and the table should say so.

grok:          returned c3b6cb30…   recomputed c3b6cb30…   ✓
devin · linux: returned 53aa2555…   recomputed 53aa2555…   ✓

devin · linux internal consistency (independent of the nonce):
  Active   = 278444  = 484 + 277960          ✓ exact
  Inactive = 1569868 = 602552 + 967316       ✓ exact
  tmpfs /tmp = MemTotal × 0.5000    /run = × 0.2000
  ulimit -u  = 31790, within 0.1% of RAM-derived max_threads/2

With two proven environments, the survey now has a calibration baseline: this is what genuine telemetry looks like, and it is the pattern the excluded submission failed to reproduce. It also means kernel-derived arithmetic — tmpfs ratios against a non-round MemTotal, capability masks, INT64_MAX sentinels — is a reliable secondary signal where a nonce is unavailable.

§9 Corrections

§10 The persistence gap

The one claim nearly every vendor makes and nobody has verified.

Five of the seven environments provide or imply a durable workspace — rclone mounts, a FUSE portal, grok-files, a host share, a persistent VM. Not one has been read from a second session.

The single environment where it was checked is chat, and the claim proved false: the rclone cache made outputs look durable within a session, and they were not. That is the entire empirical basis on the subject, and it points against the assumption everyone is making.

The test is two commands and one new session: write a timestamped marker and hash it, then read and re-hash from a fresh session. Until someone does, "persistent workspace" is a product claim, not a finding.

§11 The eighth submission, and why it has no column

• The Kubernetes cgroup path runs past f into g h i j k l. Pod IDs are hexadecimal.
• getaddrinfo on a numeric literal reported failing with a hostname-resolution error. There is no lookup to fail.
• A 2000³ benchmark implies ≈188 GFLOPS on hardware peaking at 160. Both proven environments land at 76% of peak; this one exceeds it.
• A 100 MB write into a /tmp the same document mounts as 64 MB tmpfs, reported as succeeding.
• Every memory and disk figure an exact binary power, with used and free summing precisely to total.

Error is not fabrication. §9 publishes this series' own mistakes — including two of its own, in this revision. Calling a Go binary Rust, or a desktop a shell, is a misreading of a real artifact: the observation stands and the finding survives correction. Here there is nothing to correct toward.

§12 Summary

The survey's finding has held across seven environments and five vendors: containment and capability trade against each other, but the informative variation is not how much containment there is — it is where it is placed. Cowork puts it above the boundary, Grok puts it all at the boundary, Kimi puts it in the browser, AI Studio puts it at the front door, and Devin puts it almost nowhere at all.

Two things a shared substrate does not predict: Grok and Devin both run on Cloud Hypervisor and could hardly differ more in posture; chat and Cowork share a kernel, a base image and a fleet, and differ entirely above it. The hypervisor is the least informative thing about any of these environments.

And one about method: this revision corrects two of its own findings — a desktop mistaken for a shell, and a borrowed path convention mistaken for a lineage. Both errors were made from real data, read too confidently. That is the failure mode worth guarding against once fabrication has been ruled out.