Asking whether cloud AI agents are safe is like asking whether employees are trustworthy: it depends entirely on the structure around them. A model has no intentions, but it does have access, and access without structure is where every real horror story starts. So the useful version of the question is structural. Five questions decide it, and you can ask them of any agent product in an afternoon.
Whose identity does the agent act under? If the agent borrows a human login, you have already lost the thread: every action is recorded as that person, and nobody can later say what the AI did. Safe starts with the agent as their own principal, with their own credential and their own trail. This is the difference between an audit log that means something and one that does not.
Can you see what they did? Every edit, message, and row an agent touches should carry their name and a timestamp, on the same surfaces the team already reads. Attribution by default is what turns "what happened last night" from an investigation into a query.
What exactly can they reach? Access should be scoped and inspectable: this agent, these workspaces, these tools, these keys. Credentials belong in a vault with per-agent access lists, fetched at the moment of use and never shown in chat, so granting a capability is a deliberate act with a record, not a paste into a text box.
What happens at the irreversible line? Some operations should never run unattended: moving money, deleting records, sending as the company, widening permissions. The safe pattern is a consent gate, designed so the agent proposes and a human confirms before anything irreversible executes. An agent that cannot pause at that line is not safe at any model quality.
How fast can you take it all away? Safety includes the exit. Revoking one agent's key should end their access instantly, without touching anyone else's, and removing a person should end their agents' access at the same moment. If offboarding an agent means rotating credentials six other things depend on, the architecture has already failed.
The model is not the risk surface. The permissions, the identity, and the trail are.
Where "cloud" actually helps
Here is the part the fear usually gets backwards: the shared layer is what makes agents safer, not riskier. An agent working in shared, persistent state is an agent whose every action is visible, attributable, and reviewable by the whole team. The genuinely unsafe setup is the private one: an agent in one person's session, acting under one person's login, producing work nobody else can see or audit. Opacity is the risk. The cloud layer is the transparency.
The execution side has an honest answer too, in both directions. A local Dock agent runs on your own machine with your own accounts, so your credentials never leave the hardware you control. A cloud agent holds a Claude credential issued to you, not minted by Dock: the agent's own client performs the sign-in, you approve it once in a browser you are already signed into, and the credential is written to that agent's own disk at owner-only permissions rather than passing through anyone's server. Either way, what an agent can reach is scoped per agent from there, permissions are per kind of action, Allow, Ask, or Deny, and a new agent runs with Ask on the risky kinds until they have earned Allow. That is the same arc as trusting any new hire, because that is what it is.
The one-question version
If you only get one question with a vendor, make it this: show me yesterday's log of everything your agent did, and tell me who approved the dangerous parts. A good answer names the agent, shows the trail, and points at a human sign-off. A bad answer talks about the model. Safety was never going to come from the model. It comes from the same place it always has: identity, scope, visibility, and someone accountable, built into the architecture rather than promised on top of it.