Four agent runtimes, four blast radii: the teammate interface converged, isolation did not

Shared state under Grok Bot is deliberate. SpaceXAI's documentation, according to The New Stack, describes one persistent cloud computer assigned to the user account rather than to any bot, with browser cookies and signed-in sessions shared, files visible to every bot, and command-line credentials shared ^[5][6]. Connectors are installed account-wide, one bot can resume work another saved, and the `/workspace` directory is built to survive machine updates and recovery, so the durable state belongs to the roster ^[9]. That arrangement is what makes a handoff cost nothing, and cheap handoffs are the product ^[20]. The documentation then says the honest thing: if another bot on the account cannot use a credential or a file, keep it off the machine entirely ^[8].

Read that as an operating rule and it sets a ceiling. On a single account there is no per-bot least privilege available, only two states for any secret: reachable by every bot in the roster, or absent ^[19]. A bot named Expense Manager is therefore as capable as the credentials you were willing to hand the entire office.

Hermes takes the other position, and the operator work does not disappear, it moves. Each bot is a profile with its own directory for configuration, memory, skills, credentials and chat history, and handoffs run as real invocations against the named profile rather than a context blob passed inside one process ^[10][12]. But a separate credential store is not a different credential ^[13]. Two profiles pointed at the same API token have two directories and one blast radius, and nothing in the roster interface tells you which situation you are in.

The packaging matters as much as the design. Nous shipped the teammate protocol inside v0.20.3 alongside an MCP 2.x SDK migration and runtime hardening changes, then archived the standalone plugin repository once the merge landed ^[16]. A change to what one agent can reach arrived in the same version bump as dependency maintenance.

Then the arithmetic. Only one of the four products makes the roster itself the boundary ^[14], which leaves three where the named agent is not the unit of isolation ^[15]. The units in play are an account, a profile directory, an opt-in container and the deployment topology, and they are not interchangeable ^[21]. Two of those are not properties of the software at all: an opt-in sandbox is off until someone turns it on, and a topological boundary exists only if whoever deploys it draws one. The New Stack's reading is that the documentation shows an industry converging on the persistent coworker interface faster than on what counts as an identity or a security boundary for it ^[17]. The convergence is the part that is finished. The boundary is homework, and it has been handed to the platform team without being labelled as such.