Agents that borrow your identity will not survive the enterprise. That is the claim Nikhil Harithas, who leads forward deployed engineering at Factory, made to AI Engineer while demoing Open Compute, a control layer that lets the coding agent Droid run wherever a customer demands without opening ingress.
I think he is right, because the enterprise problems he described are not hypothetical. His team works with Blackstone, a trillion-dollar manager that would not run agents on laptops, wanted to bring its own compute and inference, its own identity and single tenancy everywhere, and found Factory's defaults unusable. That forced two questions Harithas said recur with every large customer: who is the agent acting on behalf of, and where does it actually run.
The first answer is to stop piggybacking on a human. Harithas argued agents are just slightly non-deterministic applications and should be treated as such, with their own service identities instead of borrowing a sandbox tied to your permissions. The second answer is Open Compute. A client, whether Factory's CLI, Slack, Jira or your own product, asks Factory's backend for a session, the compute gateway forwards to an Open Compute controller inside the customer's VPC, the controller talks to a driver for EC2, EKS, Kubernetes or a sandbox provider like Daytona or Modal, spins up a microVM, and that machine dials out over a persistent websocket to a relay. No inbound connection is ever required, Harithas said, which matters because customers fear ingress far more than egress, and even LLM calls can stay in VPC through BYOK to Bedrock.
The strongest proof is lifecycle, not just launch. Harithas detailed what managing computers, not sessions, buys you: pause and resume, destroy and start from templates and snapshots, fork a snapshot to hand a subtask to a sub-agent, hydrate secrets from the customer's store and persist snapshots to S3. One customer hit AWS microVMs' eight-hour cap while Factory missions run for days, so the system must snapshot and rehydrate a new VM in place without the agent noticing. It also has to track bookkeeping when AWS acks a request but never creates the sandbox, or when an ack drops mid-session.
The fair case against this is complexity. A bring-your-own-compute install was not enough, Harithas said, because customers were left owning lifecycle, versioning and Terraform for the controller, retry and routing logic. He conceded distribution while still in private preview has been messy. Abstraction helps only if drivers are easy to write, and here Harithas test is elegant: give Droid the driver spec and let it generate a new driver, if it passes the spec it ships.
The daily brief
Get the free daily brief with the day's AI news, new AI startups and funding rounds every morning.
Join 64,000 other subscribers.
That points to the larger bet, which looks different from the generic sandbox wave now crowding the market. Factory says OpenCompute exposes its own API, CLI and administration panel because the layer managing compute should be useful independently of Droid, and the company plans to open source it in weeks, per its announcement, not merely publish code but make the governance independent. The Open Compute Project summit circuit has chased open hardware for a decade, this chases open placement for agents. If you are a founder weighing where to run agents for a regulated customer, do not ask how to grant them your permissions. Ask how to give them a computer they own.
