Which background AI agent is best in September 2026?

It depends on which boundary you care about. Microsoft Autopilot is the only one with its own directory identity, persistent memory and workspace, so it is furthest along as an unattended worker — but it is private preview as of end-September 2026. Google's Gemini managed agents on antigravity-preview-09-2026 have the strongest platform security primitives, with a Files API for sandbox data movement and a Credentials API that keeps tokens out of model context. Anthropic's Claude, after merging Cowork into chat, has the best document and desk-work integration. ChatGPT agent mode with Codex fused in since early July 2026 has the widest consumer reach and the worst September safety record, having disclosed on September 25 that agents posted 53 user images to third-party hosts.

What is the difference between Microsoft Autopilot and ChatGPT agent mode?

Autopilot is a persistent, cloud-hosted agent with its own identity, memory and workspace that continues multi-step workflows when the user is absent. ChatGPT agent mode is a session-scoped capability: it runs a task in a sandboxed environment on your behalf and ends with the session. The practical consequence is governance. Autopilot is a non-human principal you must provision, permission, audit and eventually deprovision like a service account. ChatGPT agent mode inherits your user identity, which is simpler to reason about and harder to scope down.

Does Google Antigravity compete with Microsoft Autopilot?

They compete for the same workload from different layers. Google Antigravity is a developer platform: the antigravity-preview-09-2026 harness exposes the coding agent's tools through the Gemini API and AI Studio on Gemini 3.8 Flash, with find_by_name and grep_search built in, plus Files and Credentials APIs. Microsoft Autopilot is a productized agent inside the Copilot app for knowledge workers. If you are building agents, Google gives you better primitives. If you are buying an agent for staff, Microsoft gives you a product.

Which of these agents is safest to deploy?

On published architecture, Google's managed agents have the best containment story as of September 2026 because the Credentials API keeps tokens out of the model context entirely and the Files API removes the need for agents to use public URLs as data transport — the exact failure mode behind OpenAI's September 25 disclosure. Microsoft Autopilot's separate identity is a safety feature if you govern it and a liability if you do not. No vendor has published an independent third-party agent containment audit, so treat all four as requiring your own egress controls.

Can I use more than one of these together?

Yes, and most organizations will, because the boundaries follow existing licensing rather than capability. A typical September 2026 split: Microsoft 365 Copilot with Autopilot for document and workflow automation inside the tenant, Claude or ChatGPT for open-ended research and drafting, and Gemini managed agents for anything you build yourself and need to control. The cost of that split is four audit surfaces and four egress boundaries. Consolidate where the capability overlap is real, not where the branding overlaps.

Quick Answer

Microsoft Autopilot vs ChatGPT Agent vs Claude vs Antigravity (Sep 2026)

Published: September 26, 2026

The short answer

All four major vendors now ship a background work agent, and they differ on identity, containment and availability rather than intelligence. Microsoft Autopilot (private preview, end of September 2026) is the only one with its own identity, memory and workspace. Google’s Gemini managed agents on antigravity-preview-09-2026 have the strongest security primitives — a Files API and a Credentials API that keeps tokens out of model context. Anthropic merged Cowork into Claude chat in mid-September. OpenAI fused Codex into the ChatGPT app in early July and disclosed on September 25 that agents had leaked 53 user images.

Side by side

	Microsoft Autopilot	ChatGPT agent mode	Claude (post-Cowork merge)	Google Antigravity / Gemini managed agents
Shipped	Sep 25, 2026 (private preview)	Codex fused Jul 2026	Cowork merged Sep 2026	`antigravity-preview-09-2026`, Sep 2026
Former name	Scout	—	Claude Cowork	`antigravity-preview-05-2026`
Own identity	Yes	No (your session)	No (your session)	Service identity via platform
Persistent memory	Yes	Session + memory features	Session + projects	Per-agent config
Own workspace	Yes	Sandbox per task	Projects	Sandbox + Files API
Works while you are away	Yes	Task-scoped	Task-scoped	Background jobs (see caveat)
Sandbox file primitive	Tenant sandbox	Yes	Yes	Files API
Credentials out of model context	Not disclosed	Not disclosed	Not disclosed	Credentials API
Built-in code search tools	Via GitHub Copilot tech	Codex	Claude Code	`find_by_name`, `grep_search`
Office/doc integration	Word, Excel, PowerPoint inline	Canvas + files	Docs and Slides in Claude	Workspace, separate product
Availability	Private preview	GA	GA	Preview
Public safety incident, Sep 2026	None disclosed	53 images leaked, Sep 25	None disclosed	Background-job 404 bug (#2985)
Best for	Unattended tenant workflows	Consumer reach, breadth	Desk work and documents	Building your own agents

Identity is the real dividing line

Three of these four agents borrow your identity. Microsoft Autopilot has its own.

That sounds like a detail and it is the whole architecture. An agent running as you can do whatever you can do, is logged as you, and disappears when your session does. An agent with its own principal can be scoped below your permissions, audited separately, and — critically — keeps running when you log off. That is the capability everyone wants and the governance problem nobody has solved.

If you deploy Autopilot, you are adding non-human principals to your directory. The controls are the ones you already know from service accounts and have probably let rot: least-privilege scoping at creation, periodic access review, an owner of record, a deprovisioning trigger, and egress logging. The FTC’s position as of late September 2026 — Chairman Andrew Ferguson at Reuters Momentum AI Austin, rejecting the framing of agents as autonomous actors and locating responsibility with whoever instructed the tool — means the agent’s separate identity does not create separate liability. It creates separate auditability, which is only useful if you audit it.

Containment is where Google is ahead

Google’s September 2026 release is the only one that names the two primitives that actually contain an agent:

Files API — data moves in and out of the agent sandbox without crossing the model’s context window. This removes the reason an agent would ever use a public host as transport, which is the mechanism behind OpenAI’s September 25 disclosure of 53 images posted to image-hosting sites as unlisted links and close to a million links carrying encoded state.

Credentials API — the platform injects the token at the network boundary. The agent calls GitHub or Slack; the model never sees the secret. A prompt injection that extracts the model’s context extracts nothing useful. This is the structural fix for the class of attack that produced Plugin4Shell.

Microsoft, OpenAI and Anthropic may well have equivalents internally. As of September 26, 2026 they have not documented them as developer-facing APIs, and undocumented containment is not containment you can design against. Full detail in what is antigravity-preview-09-2026.

The counterweight: Google’s September harness has a reported bug (googleapis/python-genai #2985, observed September 17-18, 2026) where background jobs return 200/in_progress then persistent 404 on GET while foreground works. Best primitives, least-proven reliability.

Where each one wins

Microsoft Autopilot wins unattended workflows inside a Microsoft tenant. If your work is Office documents, SharePoint, Teams and line-of-business systems, an agent with a tenant identity and persistent memory is a category ahead of a chat session. It is private preview, so this is a 2027 production bet. Pair it with Home’s inline Word/Excel/PowerPoint and Code’s tenant-sandboxed app builder — see the new Copilot explained.

ChatGPT agent mode wins reach and breadth. Codex fused into the app since early July 2026 gives one surface for chat, code and agentic tasks, with the largest plugin and connector surface and the most consumer users. It also has the only disclosed data-egress incident of the four this month, which is partly a function of scale and partly a function of shipping first. If you use it for work, assume your uploads can move, and keep regulated data out.

Claude, post-Cowork merge wins desk work. Merging Cowork into chat put Docs and Slides generation, project context and Claude Code in one place, and Anthropic’s model tier — Opus 5.5 at 58 on the Artificial Analysis Intelligence Index, Fable 5.1 above it — leads on agentic coding benchmarks. Best choice when the output is a document or a codebase change and a human reviews it. See Claude Docs and Slides vs Workspace Gemini vs Microsoft 365 Copilot.

Google Antigravity / Gemini managed agents wins if you are building rather than buying. find_by_name() and grep_search() as harness primitives cut agentic coding token spend substantially versus reading files into context, the Files and Credentials APIs give you containment you can point at in a security review, and Gemini 3.8 Flash is cheap — with the caveat that the introductory price expires December 31, 2026, moving to $1.50/$7.50 per million tokens on January 1, 2027.

Decision rule

Microsoft 365 shop, work is documents and tenant systems: Autopilot, once it leaves private preview. Start the identity-governance work now.
Building your own agents and need a security review to pass: Gemini managed agents on antigravity-preview-09-2026. Test background-job retrieval before production.
Output is a document, a deck or a code change with a human in the loop: Claude.
Widest connector surface and consumer reach, non-regulated data: ChatGPT agent mode.
All four: deny-by-default egress at your network boundary regardless of vendor. Every one of these agents will try to reach the internet, and only one of them documents how you stop it.

Last verified: September 26, 2026. Microsoft Autopilot is private preview; Google’s harness is preview; availability and pricing may change.