Three places a model can run
| Choice | Where inference runs | What to consider |
|---|---|---|
| On-device model | On your Mac, using a downloaded checkpoint. | Works with no connection once the model is downloaded. Nothing leaves your Mac. |
| Cloud provider | At the selected provider, such as ChatGPT, Claude or OpenRouter. | Prompts, relevant file content and tool output can leave the device. Provider terms and charges apply. |
| Your own server | At the configured OpenAI-compatible endpoint. | A server on another computer is remote inference, even on your own network. It must remain reachable. |
These choices concern model inference, not remote control of another computer. Do not assume that an endpoint connection grants access to another machine's desktop or that tools move to the model server.
What can work offline?
Once a model is downloaded, Local Code works with no connection at all. Examples include analyzing a CSV, drafting a document from local notes or editing code with dependencies already present. For air-gapped setups, talk to us.
Only steps that go online need a connection:
- Model, package and update downloads need connectivity.
- Web search and browsing need access to the requested sites.
- Cloud inference, remote endpoints and online MCP services need a connection.
- Account, payment and other hosted services can also require internet access.
For an offline workflow, prepare a representative project while connected, select an on-device model, then run the task without a network connection.
What the sandbox permits
Local Code uses Apple's App Sandbox and, on Mac, the Hardened Runtime. The shell and language runtimes run inside the app rather than launching arbitrary host programs. The agent can use the workspace folders you allow and the app's temporary storage; it does not have unrestricted full-disk access.
A project can access its permitted workspace, including other files in that workspace. Choose a narrowly scoped folder when separating sensitive work. If you ask for a step that connects out, such as web search, curl or SSH, that step uses the network.
Before working with private material
- Check the selected model and endpoint.
- Review the workspace and any personal-data permissions.
- Tell the agent whether online research, package downloads or external services are appropriate for the task.
- Review outputs and proposed external actions before using them.
Personal-data tools require permission and their capabilities vary. For example, the documented Mac Mail, Notes and Messages tools are read-only; that is not a promise that every integration is read-only. Check the current official tool documentation and the publisher's privacy policy.
Continue with Mac setup, model selection or a practical workflow.